Instagram App Review Keeps Failing? Here's What Meta Wants

Problem Summary

You are building an application that needs to access Instagram data or publish content via the Instagram Graph API. You have set up a Meta Developer app, added the Instagram product, requested the required permissions (instagram_basic, instagram_content_publish, instagram_manage_comments, or others), recorded a screencast, and submitted for App Review. After a week, the submission is rejected. The reason is usually 'The reviewer could not verify the use case' or 'The permission was not demonstrated as described.' You make changes and resubmit, but the cycle continues.

Symptoms

• Instagram permissions show 'In Review' for weeks, then flip to 'Rejected'
• App Review rejection reason states the reviewer could not verify the instagram_content_publish use case
• The app works for the developer's connected Instagram Business account but no one else can connect
• instagram_basic permission rejected because the app is connecting Personal (not Business) Instagram accounts
• Submission notes reference features that the reviewer could not find in the app at the provided URL
• The screencast shows the feature but the reviewer's test account is a Personal Instagram profile, not a Business account
• Rejection cites 'Platform Policy violation' without specifying which policy or which feature
• The Meta app shows 'Instagram Basic Display' and 'Instagram Graph API' as separate products and the wrong one was configured

Business Impact

Instagram API access in development mode is limited to accounts explicitly added as Testers. For a social media scheduling tool, influencer analytics platform, or content management tool, this means the product cannot onboard any paying customer until App Review passes. Each failed review cycle adds 1-3 weeks to the launch timeline. Competitors with existing approved apps have a structural advantage. Engineering time is spent on resubmissions instead of product development.

Root Cause

Instagram has two separate API products in the Meta ecosystem with different permission sets and review requirements. Instagram Basic Display API (now deprecated as of December 2024) was for Personal Instagram accounts. Instagram Graph API is for Instagram Business and Creator accounts only. Most rejections happen because the developer is confused about which API to use for their use case, or because their test account is a Personal Instagram profile rather than a Business or Creator account, which makes it impossible for the reviewer to demonstrate Graph API permissions that only work with Business/Creator accounts.

Diagnosis

Step 1: Confirm You Are Using the Instagram Graph API (Not Basic Display)

In your Meta Developer App Dashboard, check which Instagram product is added. Navigate to App Dashboard > Add a Product. You should see 'Instagram' (the Graph API product). 'Instagram Basic Display' is deprecated as of December 2024 and should not be used for new apps. The two products have completely different permission namespaces.

# Test that your access token works with the Instagram Graph API
# Replace ACCESS_TOKEN with your User Access Token from Graph Explorer

curl -X GET "https://graph.facebook.com/v21.0/me/accounts?access_token=ACCESS_TOKEN"

# This returns the Facebook Pages you manage.
# Then get the Instagram Business Account linked to a Page:
curl -X GET "https://graph.facebook.com/v21.0/PAGE_ID?fields=instagram_business_account&access_token=ACCESS_TOKEN"

# If instagram_business_account is null, the Page has no linked Instagram Business account.
# The user must go to Instagram > Settings > Account type and links > Switch to Business Account.

Step 2: Set Up a Test Instagram Business Account

Create a dedicated test Instagram account. Go to Instagram > Profile > Settings > Account > Switch to Professional Account > Business. Link it to a Facebook Page (the Page can be a test Page you create in Meta Business Suite). Add this Instagram account as a Tester in your Meta Developer app. This is the account the reviewer must use.

Step 3: Verify Business Verification Is Complete

Certain Instagram Graph API permissions require Meta Business Verification. Navigate to Meta Business Suite > Business Settings > Business Info > Business Verification. Without Business Verification, permissions like instagram_content_publish for use in third-party publishing tools will be blocked at the review stage.

Step 4: Audit Your Use Case Justification

Each Instagram permission submission requires a use case description. Meta's reviewers compare your stated use case against the feature demonstrated in the screencast. If you request instagram_content_publish with a justification of 'schedule posts for users' but the screencast shows a manual one-time post with no scheduling interface, the use case does not match and will be rejected.

## Permission: instagram_content_publish

## Use Case
Our app allows social media managers to schedule Instagram posts on behalf of
their clients' Instagram Business accounts. Users authenticate with Instagram,
connect their client's Business account, compose a post with image/caption,
select a future publish time, and our backend calls the Instagram Graph API
at the scheduled time to create the media container and publish it.

## Data Accessed
- We access instagram_content_publish to create and publish media objects
  (images and videos) to the connected Instagram Business account
- We do not store the published content after confirmation of publication
- We store the Instagram Business Account ID and User Access Token (encrypted)
  to enable scheduled publishing

## User Control
- Users can disconnect their Instagram account at any time from our app settings
- Disconnecting revokes our access token and deletes all scheduled posts
- We provide a link to Instagram's connected apps settings for token revocation

Step 5: Test the Complete API Flow Before Recording the Screencast

Before recording the screencast, use the Meta Graph API Explorer to verify every API call works with the test account credentials. Graph Explorer is at developers.facebook.com/tools/explorer. Generate a User Access Token with all required scopes and test each endpoint your app calls. This catches permission errors before the reviewer encounters them.

// Step 1: Create a media container
const createContainer = await fetch(
  `https://graph.facebook.com/v21.0/${igBusinessAccountId}/media`,
  {
    method: "POST",
    body: new URLSearchParams({
      image_url: "https://yourcdn.com/image.jpg", // Must be publicly accessible
      caption: "Your caption here #hashtag",
      access_token: userAccessToken,
    }),
  }
);
const { id: containerId } = await createContainer.json();

// Step 2: Check container status (for videos, wait until status is FINISHED)
const statusCheck = await fetch(
  `https://graph.facebook.com/v21.0/${containerId}?fields=status_code&access_token=${userAccessToken}`
);
// status_code values: IN_PROGRESS, FINISHED, ERROR, EXPIRED

// Step 3: Publish the container
const publish = await fetch(
  `https://graph.facebook.com/v21.0/${igBusinessAccountId}/media_publish`,
  {
    method: "POST",
    body: new URLSearchParams({
      creation_id: containerId,
      access_token: userAccessToken,
    }),
  }
);
const { id: mediaId } = await publish.json();

Production Failure Scenarios

Scenario 1: Reviewer's Test Account Is a Personal Instagram Profile

The test account provided in submission notes has a Personal Instagram profile linked to the Tester Facebook account. When the reviewer attempts to connect the Instagram account in the app, the app correctly calls the Graph API to retrieve instagram_business_account but receives null. The app shows an error or empty state. The reviewer cannot proceed and rejects the submission. Fix: explicitly state in submission notes that the Instagram account must be a Business or Creator account, and pre-configure the test account accordingly.

Scenario 2: Image URL Not Publicly Accessible

The app constructs image_url parameters using signed S3 URLs or CDN URLs behind authentication. Instagram's servers must be able to access the image URL to create a media container. If the URL requires authentication headers or expires before Instagram's servers fetch it, the media container creation fails with OAuthException error code 9007 or a media_creation error. Fix: use public CDN URLs without signatures for Instagram media publishing, or use long-lived public URLs.

Scenario 3: instagram_basic Rejected Because Connected to Personal Account

The app requests instagram_basic via the Graph API product but the connected accounts are Personal Instagram profiles. The instagram_basic permission in the Instagram Graph API only works with Business/Creator accounts. For Personal accounts, instagram_basic was part of the deprecated Basic Display API. Since Basic Display API is deprecated, this use case is no longer supported. Apps that need personal account access must pivot to a different approach or focus exclusively on Business/Creator accounts.

Prevention Checklist

• Create and configure a dedicated Instagram Business test account before beginning App Review submission
• Verify the test Instagram account is linked to a Facebook Page in the Meta Business Suite
• Add the test account's Facebook user as a Tester in the Meta Developer app
• Include explicit instructions in submission notes: 'This app requires an Instagram Business or Creator account'
• Test every API endpoint used by the app in Meta Graph API Explorer with the test account credentials before recording the screencast
• Record the screencast showing the Instagram Business account connection, permission grant dialog, and the feature using the permission
• Ensure all media URLs used during testing are publicly accessible without authentication
• Complete Meta Business Verification before submitting for permissions that require it
• Write use case justifications that exactly match the workflow shown in the screencast
• Do not request instagram_basic if you only need to publish it is not required for content publishing

Resolution Summary

The App Review failures were caused by: the test account being a Personal Instagram profile (not a Business account), the submission notes not specifying the Business account requirement, and the use case justification describing scheduled publishing while the screencast only showed immediate posting. After converting the test account to a Business profile, linking it to a Facebook Page, updating the notes with account type requirements, and recording a new screencast that demonstrated the scheduling workflow end-to-end, the permissions were approved on the next submission.

Lessons Learned

• Instagram Graph API is exclusively for Business and Creator accounts document this requirement for your users and your test setup
• The Instagram Basic Display API deprecation in December 2024 invalidated many existing integration patterns verify which API your app uses
• Submission notes must pre-empt every step the reviewer might get wrong over-documenting is better than under-documenting
• The use case justification and the screencast must tell the same story any mismatch between what you describe and what you demonstrate triggers rejection
• Test API calls in Graph Explorer with the actual test account before investing time in a screencast recording

Conclusion

Instagram Graph API App Review failures almost always trace back to account type mismatches (Personal vs. Business), insufficient submission notes, or a mismatch between the stated use case and the screencast demonstration. The review process is strict because Instagram's platform policies around third-party access to user content are strictly enforced. Invest in the quality of your submission package and the correct test account setup before your first submission it saves weeks of review cycle time.