The Instagram Graph API reads business and creator accounts that log in to your app: their posts, comments, insights, mentions and messages. It’s also the only way to publish, reply to comments or answer DMs from code. For an account that hasn’t logged in to your app, Meta offers one route, Business Discovery, and it returns another professional account’s public counts and post stats.
Personal accounts, comments on someone else’s post, followers lists and other people’s stories aren’t in any Meta API a company can use. LurkAPI reads the first two for any public account, with one key. So before you create a Meta app, check whose data you need:
Reading another account: Business Discovery
If you’re vetting creators, know this before you trust their numbers: the reel view count Business Discovery returns includes paid views, and Facebook views when the reel was crossposted there. A creator who put ad money behind a reel gets the ad’s views in the total, so they look bigger than their audience is.
To read Blue Bottle Coffee’s numbers through Business Discovery, you need your own Instagram professional account, linked to a Facebook Page, and a Facebook Login token with three permissions. Then you query your own account and name Blue Bottle inside the fields:
GET https://graph.facebook.com/v25.0/<YOUR_IG_USER_ID>
?fields=business_discovery.username(bluebottle)
{followers_count,media_count,media{comments_count,like_count,view_count}}
&access_token=<YOUR_FACEBOOK_USER_TOKEN>For the account: bio, website, follower count and post count. For each post: caption, media URL, like count (gone if the owner hides likes), comment count and, on reels, that view count. There’s no comment text, no stories, no followers list, and no saves, shares or insights. Personal and age-gated accounts return nothing, and the post IDs it lists can’t be opened on their own: a GET on any of them fails for lack of permission. Each call reads one account, so a list of 500 usernames is 500 calls against a limit Meta doesn’t publish.
Tokens die at 60 days, and the limit isn’t 200 calls an hour
There’s no Instagram API key. Meta gives your app an ID and a secret, and every call carries a token for one user. A login gets you a token that lasts an hour; trade it for a long-lived one and it lasts 60 days. Once it’s a day old you can refresh it, which makes it good for 60 days from that moment. Let it reach day 60 and it can’t be refreshed at all: that user has to log in to your app again. So refresh every token on a schedule (weekly is plenty) and store when you last did.
The figure you’ll see quoted, 200 calls an hour, is the Graph API’s formula for an app token with one user. Instagram’s own budget is per app and account: 4,800 calls in a rolling 24 hours, times the number of impressions that account’s content got in the same window. Business Discovery is left out of it. It runs on the Graph API’s per-user limit, and Meta doesn’t publish that number, so you find it when calls start failing.
App Review comes in only when your app serves accounts you don’t own or manage. Then you need Advanced Access, which means App Review plus Business Verification, and at least one successful API call before you can apply. An app for your own business stays on Standard Access and skips review.
If a tutorial sends you to the Basic Display API, skip it. Meta switched it off on December 4, 2024, and every request now returns an error, even though Meta’s Instagram product page still lists it. Nothing replaced it for personal accounts.
For accounts you don’t own, one key reads any public profile
If the accounts aren’t yours, LurkAPI’s Instagram endpoints read any public account’s profile, posts, reels and comments, personal accounts included. You skip the Facebook Page, App Review and token refreshes, and your key works until you revoke it. A call costs 1 credit, which is $0.45 to $0.90 per 1,000 calls depending on the pack.
curl -G https://api.lurkapi.com/v1/instagram/profile \
--data-urlencode "username=bluebottle" \
-H "x-api-key: $LURK_KEY"Experience the best of what coffee has to offer.
The JSON behind the card
{
"success": true,
"credits_charged": 1,
"data": {
"pk": "354032059",
"id": "17841401441775531",
"username": "bluebottle",
"full_name": "Blue Bottle Coffee",
"biography": "Experience the best of what coffee has to offer.",
"is_private": false,
"is_verified": true,
"follower_count": 518198,
"following_count": 806,
"media_count": null,
"external_url": "https://bluebottlecoffee.com/us/eng/product/notes-in-repose-vinyl",
"bio_links": [
{
"url": "https://bluebottlecoffee.com/us/eng/product/notes-in-repose-vinyl",
"title": "Notes in Repose"
},
{
"url": "https://bit.ly/4dd5bHz",
"title": "Subscribe and Stay Updated"
},
{
"url": "https://bluebottlecoffee.com/us/eng",
"title": "Shop Blue Bottle Coffee"
},
{
"url": "https://links.orion.bluebottlecoffee.com/?utm_source=landing_page&utm_medium=hero_cta&utm_campaign=membership",
"title": "Blue Bottle Membership"
},
{
"url": "https://bit.ly/49hmWn1",
"title": "Brew Guides"
}
],
"category": "Coffee shop"
}
}Blue Bottle’s Coltrane reel shows 36 comments. Business Discovery gives you that number; only Blue Bottle’s own token can list them. Post comments lists them from the reel’s link, a page at a time: pass each page’s end_cursor back as after. Two calls returned all 30 comments on this reel (Instagram’s 36 counts replies too).
The two calls and the last page
# Page 1, then pass its end_cursor back as after
curl -G https://api.lurkapi.com/v2/instagram/post/comments \
--data-urlencode "url=https://www.instagram.com/reel/DdWpu4yMpxk/" \
-H "x-api-key: $LURK_KEY"
curl -G https://api.lurkapi.com/v2/instagram/post/comments \
--data-urlencode "url=https://www.instagram.com/reel/DdWpu4yMpxk/" \
--data-urlencode "after=$END_CURSOR" \
-H "x-api-key: $LURK_KEY"{
"success": true,
"credits_charged": 1,
"comments": [
{
"pk": "18130377853767462",
"text": "Love these animations! Who is the artist??",
"created_at": 1789662589,
"comment_like_count": 0
},
{
"pk": "18156358942502477",
"text": "blue bottle X blue note 🤝",
"created_at": 1789651977,
"comment_like_count": 8
},
"…13 more"
],
"end_cursor": null,
"has_next_page": false
}For a private account, the profile comes back with is_private: true and no posts. To see it work before you write any code, the free Instagram lookup shows any public profile and its latest posts, with no login.
