Your Instagram embed will die in 60 days (and how to stop it)

You ship an Instagram grid on a marketing site. It looks great in staging. Three months later the homepage shows an empty box — or worse, last month’s posts forever — and nobody filed a ticket because nothing “crashed.”

This is not bad luck — it is how Meta’s Instagram access tokens work.

Why Instagram tokens die

Business and Creator accounts only (personal accounts lost API access when Basic Display shut down on 4 December 2024). The flow:

1. User completes OAuth → you get a short-lived token (hours).
2. You exchange it for a long-lived token (~60 days).
3. Before that window closes, you must call the refresh endpoint and persist the new token.
4. If you miss the window, refresh fails. The user has to log in again.

Refresh is roughly:

GET https://graph.instagram.com/refresh_access_token
  ?grant_type=ig_refresh_token
  &access_token={long-lived-token}

Gotchas:

• Refresh only works while the token is still valid (usually only after it is older than 24 hours).
• Password changes and security checkpoints invalidate the session — refresh will not save you; re-auth is required.
• Even with a healthy token, Instagram CDN media_url values expire. Cached pages that stored those URLs show broken images later.

Fetching once and saving JSON is not enough. You need a scheduler, durable token storage, error alerts, and your own media copies.

DIY Graph refresh (sketch)

If you want to own it, the minimal viable loop is:

every day (real cron, not "when someone visits"):
  1. Load stored long-lived token
  2. If token age > ~50 days (or always weekly): call refresh_access_token
  3. Save the new access_token + expires_in
  4. Fetch /{ig-user-id}/media with fields you need
  5. Download media to your bucket/CDN; store stable URLs in your DB
  6. On Graph errors (especially code 190): alert a human, do not silently render an empty grid

In Next.js / Node use a real cron (Vercel cron, GitHub Action, worker). In PHP do not rely solely on WP-Cron on a quiet site.

Also budget Meta app review (when needed), API version upgrades, and field-name churn.

DIY is free in dollars. It is not free in on-call.

Why WordPress Instagram plugins go blank

Plugins like Smash Balloon do the right idea: store a token, refresh on a schedule, render a grid. The failure mode is environmental:

• WP-Cron is fake cron — it runs on page views. Quiet sites may never fire refresh near day 60.
• Failures are often quiet: empty or stale markup; marketing is not watching wp-admin.
• Password/session changes surface as API error 190 — reconnect fixes it, but only if someone notices.

On WordPress: real system cron → wp-cron.php, alert on API errors, document re-auth for clients. Off WordPress (or tired of owning Meta’s token lifecycle): a hosted feed API moves that loop off your servers.

Hosted options, compared (developer lens)

Not every “Instagram widget” product is the same. For code that needs data, check JSON access, image hosting, refresh behaviour, and what happens when free quota runs out.

Approach	Best for	Watch-out
DIY Graph API	Full control, unusual fields	Token refresh, Meta app, expiring media URLs
Smash Balloon	WordPress grid UI	WP-only; renewal pricing; still depends on cron/reconnect
Behold	Polished widget + public JSON	Free tier ~1,200 views/mo, then account paused; paid plans still meter views on most tiers
Feedframer	REST / GraphQL / RSS, flat pricing	Free capped at 6 posts (not views); Premium $6/mo or $60/yr

A useful third-party roundup (Sep 2026) that scores JSON, Reels, carousels, and image hosting side by side: Instagram Feed APIs for Developers, Compared.

Behold and view caps

Behold is strong if you want a drop-in widget. The free-tier trap is the view meter: hit the cap and feeds pause until next month — honest metering, surprising outage on a shared client launch.

Smash Balloon and WordPress

On WordPress with layouts and a customizer, Smash Balloon is the incumbent. It is not an API for Astro or a Klaviyo RSS block, and token issues still appear when cron or re-auth is neglected.

Feedframer (what I built)

I got tired of re-implementing OAuth + refresh + CDN for “just show my posts.” Feedframer is a small Instagram Feed API: connect a Business/Creator account once; we refresh tokens, fetch on a schedule (daily Free / hourly Premium), copy media to our CDN, and expose REST, GraphQL, or RSS on one key.

Free: 6 posts/account, unlimited API calls, all three formats, no card.

Premium: $6/month or $60/year — more accounts/posts, hourly refresh, responsive sizes.

In the 30 days to 25 October 2026 we served ~1.1M requests, 840K media files, 1.8 TB, and 130K API calls — mostly without marketing. The token problem is real enough that people find a fix when they need one.

When DIY vs hosted

Stay DIY when:

• You already have a Meta app in production and an on-call rotation that understands Graph errors.
• You need fields or workflows a host does not expose.
• Compliance requires tokens and media to never leave your VPC.

Prefer hosted when:

• You are embedding your (or a client’s) feed on a site and do not want a Meta project per client.
• You need RSS for Mailchimp/Klaviyo without building a bridge.
• You have been burned by a blank homepage and do not want a 60-day calendar reminder.
• You want unlimited request volume on a cheap plan without a view counter pausing the widget.

Prefer a WordPress plugin when:

• The CMS is WordPress and stakeholders want a visual grid builder more than a JSON response.

A practical checklist either way

1. Confirm the Instagram account is Business or Creator.
2. Never rely on Instagram CDN URLs in a long-lived cache — copy media.
3. Refresh tokens on a real scheduler; alert on auth errors.
4. Decide what “at the free limit” means for your vendor (pause? watermark? soft upgrade nag?) before you put it on a client domain.
5. Document re-auth steps for whoever owns the Instagram password.

Soft CTA

Hosted path: connect once at feedframer.com, copy the key, GET /api/v1/me. Free is enough for a portfolio; upgrade for more than six posts or hourly updates.

DIY path: automate refresh this week — not on day 59. Future you will not thank you, but they also will not page you about an empty grid.