The real cost of Instagram data in 2026 (measured, not estimated)

I spent the last week building a small "who unfollowed me" tool, which means I needed one boring thing: the follower list of an Instagram account. Here is everything I measured while figuring out how to get it in 2026 — what's dead, what's free, and what the paid options actually cost.

The free paths are mostly dead

Follower lists require a logged-in session. Period. I tried three separate unauthenticated paths (web API, GraphQL, mobile endpoints) and every one returns 401 for list data. No header combination fixes it.

Follower counts are still public — web_profile_info with the x-ig-app-id header returns the count, privacy flag, and following count in one response. But it's aggressively rate-limited per IP: in my tests, roughly 20 requests inside a 30–60 minute sliding window trips a 401 block that recovers after ~29 minutes. Spacing requests out doesn't help; it's a sliding window, not a fixed quota.

Don't bother from cloud servers. The same endpoint that worked from my home IP returned 429 with a 0-byte body in 16ms on the very first request from a cloud IP (I tested from a Vercel build container). That's not my usage history — that's the entire IP range being pre-banned. Public cloud IPs inherit the abuse history of every tenant before you, so you cannot have a "clean" cloud IP.

And no, the user's own browser can't do it for you. Even if your user is logged into Instagram, your web app's origin can't read Instagram responses — CORS blocks it, and no-cors mode gives you an opaque 0-byte response. This is a browser guarantee, not something you can engineer around.

The one genuinely free path: the official data export

Instagram's "Download your information" export gives every user their own follower/following lists as JSON or HTML — and it works for private accounts too. If your product can tolerate a "request export, come back later" flow, this costs exactly $0.

Parsing it has landmines, though:

• followers_1.json and following.json have different schemas — followers keep the handle in string_list_data[0].value, but following keeps it in title, and the value field simply doesn't exist there.
• Non-ASCII display names arrive mojibake'd (UTF-8 bytes decoded as latin-1: 이름 becomes ì´ë¦). Handles are ASCII-safe, but you must repair names before showing them.
• Exports expire in 4 days, and a "full" export can be 500MB+ because it includes DMs — read the ZIP's central directory and slice out just the two files you need instead of unpacking it.

What hosted APIs actually cost

For the "type a handle, get results now" flow, I ended up on HikerAPI after comparing alternatives. Numbers from my real usage, not the pricing page:

• A full scan of a ~1,060-follower account took 43 requests, about 3 minutes (cursor-chained pagination, so you can only parallelize followers vs following, not pages).
• Page sizes differ per endpoint family and it matters for cost: the g2 follower endpoint returns 25 users per billed request, while g1 returns 46 per billed request — same data, nearly half the cost. The docs don't advertise this; I found it by reading their public OpenAPI spec and testing.
• Billing is verifiable: /sys/balance shows a request counter, and I confirmed call-by-call that list pages bill exactly 1 unit — and that a deprecated endpoint returning 410 billed nothing.
• Accuracy: I cross-checked one page of API results against data collected directly from Instagram's web interface — 89/90 matched, and the one mismatch was a follower gained between snapshots.
• Cost at the $100 prepaid tier: $0.001/request, so ~$0.04 per 1,000 followers scanned with the 46-per-page endpoint.

Two honest gotchas: card top-ups carry a 15% fee deducted from your balance (only crypto avoids it), and until you've deposited $100 total you pay ~20x per request, which makes small-scale testing feel more expensive than the steady state.

For comparison, the cheapest Instagram scraper actors I tested on Apify worked out to 9–20x more per follower than the numbers above — partly because one actor advertised "50 users per $0.009 batch" but returned 25 users while billing the full batch. Always measure billed units, not advertised prices. Enterprise proxies (Bright Data class) were 30x+ for this use case.

A curl you can verify all of this with

# profile gate: 1 request buys you count + privacy flag
curl -H "x-access-key: $KEY" \
  "https://api.hikerapi.com/v1/user/by/username?username=instagram"

# follower page: 1 request, ~46 users, cursor in response
curl -H "x-access-key: $KEY" \
  "https://api.hikerapi.com/g1/user/followers?user_id=25025320"

(One quirk: their Cloudflare config rejects Python's urllib user-agent with a 403 — curl and normal HTTP clients are fine.)

Takeaways

1. Decide early whether your product needs lists or just counts — counts are free-ish from a residential IP, lists are never free without the user's own export.
2. If you go hosted, read the OpenAPI spec and measure billed units yourself — endpoint families differ by ~2x in cost for identical data, and advertised prices routinely don't survive contact with real usage.
3. Keep the official export flow as a fallback: it's the only path that covers private accounts, and it costs nothing.

What else are people using for this in 2026? Especially curious if anyone has a cleaner answer for private-account analytics than the export flow.