Do you need your own OAuth app?
Composio managed: yes (checked 2026-10-20). Composio-managed OAuth is available. You can start without your own OAuth app.
Bring your own app when:
- The consent screen must show your brand, not "Composio"
- You need custom scopes
- You need your own rate quota (managed apps share quota)
- You need polling faster than 15 minutes (the managed minimum)
- You connect to a custom or self-hosted instance
- Enterprise customers require your branding end-to-end
- Leaving managed auth means your own Meta app needs Business Verification and per-permission App Review before anyone without a role on the app can connect (Meta access-level rules).
- You need permissions beyond what Composio's managed app requests, for example messaging or content publishing; each one is reviewed separately (inferred).
Composio lists Instagram as a Composio-managed OAuth toolkit. Only Instagram professional accounts (business or creator) can connect through the Instagram Platform. If you bring your own app, expect weeks of waiting; Meta publishes no review-time commitment. Copy the redirect URI from the Composio dashboard (Create Auth Config).
Redirect URI: Copy the callback URL from the Composio dashboard (Create Auth Config); don't hard-code it.
Switching to your own app affects new connections only. Existing connected accounts stay on the old auth config until users re-authenticate.
Composio managed-auth directory ↗Custom app vs. managed app ↗White-labeling authentication ↗
Verdict
The "weeks of waiting" case. Testing works only for people with a role on your app. Any other user needs Advanced Access: Meta Business Verification of your company plus App Review of each permission, with no official review-time commitment. Professional accounts only.
- Difficulty
- 4/5 · Hard
- Approval
- app review
- Confidence
- medium
- Test before approval
- Yes
Why this score
- Meta Business Verification (business-verification, weight 4)
- Meta App Review per permission (app-review, weight 4)
Dev-ready
Your own Instagram professional account, added to the app, can log in and call the API with Standard Access.
- Hands-on
- 0.5–1.5 h
- Wait
- no wait
basis: estimate
Limits until next
- Only Instagram professional accounts (business or creator) are supported.primarysource
Pilot-ready
Pilot users you add to the app (as testers or other roles) can connect their professional accounts.
- Hands-on
- 0.25–1 h
- Wait
- no wait
basis: estimate
Limits until next
- With Standard Access, permissions can only be requested from users who have a role on your app.primarysource
Production-ready
Any Instagram professional account can connect: Advanced Access granted after Business Verification and App Review.
- Hands-on
- 8–24 h
- Wait
- 9+ days
basis: communityReported by developers, not a commitment
Limits until next
- Meta publishes no App Review SLA. A June 2026 developer report says the dashboard reads "Most submissions are reviewed within 20 days", with commenters reporting 9–29 days. Business Verification is reported (secondary) as up to 14 business days. Reported by developers, not a commitment.secondaryReported by developers, not a commitmentsource
Next actions
- Create the Meta app with the Instagram use case (human) — done when: Your own professional account completes login and you get a token.
- Business Verification (human) — done when: The app shows a connected, verified Business.
- App Review per permission (both) — done when: Each requested permission has Advanced Access.
Blockers
- highAdvanced Access requires Business Verification. Without a verified Business, users from other businesses can't grant permissions and features stay inactive. (Production-ready)Workaround: Start Business Verification early, before you plan to submit for App Review.
- highIf reviewers can't access your app, the whole submission is rejected; untestable permissions are denied. (Production-ready)Workaround: Provide working test credentials and screencasts that follow the exact reviewer path.An agent can help with this.
- mediumPersonal Instagram accounts can't connect; only business or creator accounts. (Dev-ready)Workaround: Ask users to switch to a professional account (free in the Instagram app).
Before you start
- Meta developer account and a professional Instagram account (human · Dev-ready): A Facebook account with developer access, plus an Instagram business or creator account to test with.
- Business portfolio and legal-entity documents (human · Production-ready): Connect the app to a Business; only a Business admin can complete verification in Business Manager.
- Screen recordings and reviewer access (both · Production-ready): A recording per permission showing its use, working test access for reviewers, a 1024x1024 app icon, and a successful API call within 30 days before submitting.
Gates
- Standard Access: only users with a role on the app (testing cap)Applies when: until Advanced Access. Required for Pilot-ready.
- Meta Business Verification (business verification)Applies when: Advanced Access. Required for Production-ready.Duration: Reported as up to 14 business days by a Meta business solution provider; Meta's own developer docs give no timeline.secondaryReported by developers, not a commitmentsource
- Meta App Review per permission (app review)Applies when: Advanced Access. Required for Production-ready.Duration: About 20 days per a reported dashboard message; developers report 9–29 days.secondaryReported by developers, not a commitmentsourceRecurring: Apps with Advanced Access must complete the annual Data Use Checkup.primarysource
Scopes
| Scope | Sensitivity | Why | Review trigger |
|---|---|---|---|
| instagram_business_basic | unknown | Read the connected professional account's profile and media.Draft: The agent reads the user's own recent posts to draft captions and reports for them. | Advanced Access via App Review for users without a role on the app. |
| instagram_business_manage_comments | unknown | Read and reply to comments on the account's media. | Separate App Review approval. |
| instagram_business_content_publish | unknown | Publish posts on the user's behalf. | Separate App Review approval. |
Setup steps
- Create the Meta app with the Instagram use case (create · human · ~45 min)
- developers.facebook.com/apps → Create app → Instagram API with Instagram Login (no Facebook Page needed).
- Add the Composio redirect URI in Business Login settings.
- Add your professional account and pilot users as testers.
- Business Verification (submit · human)
- App Dashboard → Settings → Basic → Verification → Start Verification.
- A Business admin completes verification in Business Manager with company documents.
- App Review per permission (submit · both)
- Make a successful call for each permission within 30 days before submitting.
- Record a screencast per permission and write reviewer instructions with working test access.
- Submit, then keep the test access working until approval.
- Go live and calendar the Data Use Checkup (launch · human · ~15 min)
- Switch the app to Live mode.
- Set a yearly reminder for the Data Use Checkup.
OAuth configuration
- Redirect URIs:
- Meta redirects to your registered redirect URI with an authorization code.primarysource
- PKCE:
- unknown
- Token lifetime:
- The code yields a short-lived token; exchange it for a long-lived token valid for 60 days.primarysource
- Refresh:
- No refresh token: refresh the long-lived token itself once it is at least 24 hours old and before it expires. Tokens not refreshed within 60 days die.primarysource
- Rate limits:
- unknown
Agent vs. human
Agent can do
- Draft per-permission use-case descriptions and the screencast script.
- Write reviewer test instructions and check that test access works.
- Check that the privacy policy and data-deletion URLs are reachable.
Human must do
- Facebook login and 2FA; create the app.
- Business admin: complete Business Verification with company documents.
- Record screencasts and submit App Review.
- Complete the annual Data Use Checkup.
Probe results
GET https://www.instagram.com/.well-known/openid-configuration→ 200OIDC discovery: issuer https://www.instagram.com, authorization_endpoint https://www.instagram.com/oauth/dialog, response_types [code]. No code_challenge_methods_supported listed. (2026-10-19T20:37:20Z)GET https://www.instagram.com/oauth/authorize?client_id=oauth-atlas-probe&redirect_uri=https%3A%2F%2Fexample.com%2Fcb&response_type=code&scope=instagram_business_basic→ 200Returns the Instagram web app shell (about 587 KB HTML). No server-side client_id error is visible without a logged-in session. (2026-10-19T20:37:21Z)
Evidence
- [ev-levels] Standard Access works only for users with a role on the app; Advanced Access requires Business Verification. primary high confidence
However, Business Verification is required to get Advanced Access.
https://developers.facebook.com/docs/graph-api/overview/access-levelsofficial-doc · retrieved 2026-10-19T20:51:04Z - [ev-bv] Only a Business admin can complete Business Verification. primary high confidence
Note that anyone with an Administrator role on your app can connect it to a Business, but only someone with an Admin role in the Business will be able to complete the verification process.
https://developers.facebook.com/docs/development/release/business-verificationofficial-doc · retrieved 2026-10-19T20:51:05Z - [ev-review] Reviewers test the app; inaccessible apps are rejected entirely. primary high confidence
If we are unable to access your app to test it, your entire submission will be rejected.
https://developers.facebook.com/docs/app-reviewofficial-doc · retrieved 2026-10-19T20:51:09Z - [ev-review-sub] A successful API call must be made within 30 days before submitting. primary high confidence
A successful call must be made within 30 days of submitting for App Review.
https://developers.facebook.com/docs/app-review/submission-guideofficial-doc · retrieved 2026-10-19T20:51:21Z - [ev-professional] The Instagram Platform serves professional (business and creator) accounts. primary high confidence
The Instagram Platform is a collection of APIs that allows your app to access data for Instagram professional accounts, including business and creator accounts.
https://developers.facebook.com/docs/instagram-platform/overviewofficial-doc · retrieved 2026-10-19T20:51:14Z - [ev-iglogin] Instagram API with Instagram Login doesn't require a linked Facebook Page. primary high confidence
There are two Instagram API configurations: Instagram API with Instagram Login serves Instagram professional accounts without requiring a linked Facebook Page.
https://developers.facebook.com/docs/instagram-platform/overviewofficial-doc · retrieved 2026-10-19T20:51:14Z - [ev-scopes] Current scope names are instagram_business_*. primary high confidence
The new scope values are: instagram_business_basic instagram_business_content_publish instagram_business_manage_messages instagram_business_manage_comments
https://developers.facebook.com/docs/instagram-platform/instagram-api-with-instagram-login/business-loginofficial-doc · retrieved 2026-10-19T20:51:17Z - [ev-duc] Data Use Checkup is annual and required before switching to Live mode. primary high confidence
In addition, developers do not need to complete DUC while the app is in Development mode , but will need to complete DUC before the app can be switched to Live mode.
https://developers.facebook.com/docs/development/maintaining-data-access/data-use-checkuppolicy · retrieved 2026-10-19T20:51:19Z - [ev-review-time] App Review reportedly takes about 20 days (9–29 reported). secondary low confidence Reported by developers, not a commitmenthttps://www.reddit.com/r/facebook/comments/1u1h6rl/community · retrieved 2026-10-20
- [ev-probe-oidc] Instagram publishes OIDC discovery with authorization_endpoint /oauth/dialog. tested high confidencehttps://www.instagram.com/.well-known/openid-configurationtest · retrieved 2026-10-19T20:37:20Z
Unknowns
- Official App Review duration: Meta publishes none; the ~20-day figure is a community report.
- Business Verification duration: "up to 14 business days" seen only via secondary sources.
- PKCE support for Instagram Login: not in the discovery doc or the pages we fetched.
- Rate limits for the Instagram API with Instagram Login: not researched.
- Whether Composio's managed Instagram app already holds Advanced Access for the permissions you need.
Corrections
- 2026-10-20: Meta App Review time —
A few days.→ No official SLA. The dashboard reportedly says most submissions are reviewed within 20 days (community report, 2026). (Developer reports in 2026; Meta's App Review docs we fetched give no timeline.)