How to Scrape Instagram in 2026 (API & Python)

The fastest way to scrape Instagram in 2026 is to call a structured Instagram API that returns normalized JSON — public profiles, posts, and reels — instead of driving a headless browser past Instagram's logins and anti-bot defenses. DIY is possible but Instagram is heavily gated and aggressively defended, and personal data raises real privacy concerns. This guide covers all three approaches, what each returns, where each breaks, and the legal basics.

Is it legal to scrape Instagram?

Tread carefully. Scraping public Instagram data (public profiles, public posts) is lower-risk than gated data, and hiQ v. LinkedIn held that accessing public data isn't a CFAA violation — but Instagram's Terms prohibit automated access, much of the value is personal data governed by GDPR/CCPA, and anything behind a login is off-limits. Rules of thumb: public, non-personal data only; never bypass logins; avoid collecting personal data without a lawful basis; review Instagram's terms. See is web scraping legal. Not legal advice.

Option 1: DIY in Python (and why it breaks)

For public profiles, Instagram exposes a web endpoint that returns the profile plus its latest ~12 posts without a login — everything beyond that needs a logged-in headless browser:

import requests

resp = requests.get(
    "https://www.instagram.com/api/v1/users/web_profile_info/",
    params={"username": "example"},
    headers={"User-Agent": "Mozilla/5.0", "X-IG-App-ID": "936619743392459"},  # required, undocumented
)
user = resp.json()["data"]["user"]
print(user["full_name"], user["edge_followed_by"]["count"])

It works in a demo and then breaks:

• Heavy rate limiting — the endpoint caps around 200 requests/hour per IP and bans datacenter IPs instantly, so you need many rotating residential IPs with sticky sessions.
• Login walls beyond profiles — full post history, comments, stories, and followers require auth, which crosses ToS and privacy lines.
• TLS & header fingerprinting — Python clients have detectable TLS signatures and the required X-IG-App-ID/headers shift, so requests get flagged.
• The Graph API won't help — Meta's Instagram Graph API serves only your own Business/Creator accounts, not arbitrary public users.

Option 2: No-code tools

Visual extractors and browser extensions export CSV/JSON — fine for one-off public pulls, less so for in-product pipelines with predictable fields.

Option 3: A structured Instagram API

For repeatable workflows over public data, an Instagram scraping API returns normalized JSON with no browser to run. Fetch a public profile:

curl https://api.crawlora.net/api/v1/instagram/profile/USERNAME \
  -H "x-api-key: $CRAWLORA_API_KEY"

The same call in Python:

import requests

profile = requests.get(
    "https://api.crawlora.net/api/v1/instagram/profile/USERNAME",
    headers={"x-api-key": "YOUR_API_KEY"},
).json()["data"]
print(profile.get("username"), profile.get("followers"))

A response is normalized JSON (fields are illustrative — check the docs):

{
  "code": 200,
  "msg": "OK",
  "data": {
    "username": "example",
    "full_name": "Example Brand",
    "followers": 184000,
    "posts_count": 420,
    "is_verified": true
  }
}

Posts and reels are addressed by the user's numeric id (from the profile), not the @handle, so fetch the profile first:

h = {"x-api-key": "YOUR_API_KEY"}
base = "https://api.crawlora.net/api/v1/instagram"

profile = requests.get(f"{base}/profile/example", headers=h).json()["data"]
uid = profile["id"]
reels = requests.get(f"{base}/reels/{uid}", headers=h, params={"max_id": ""}).json()["data"]
post = requests.get(f"{base}/post/{uid}/POST_ID", headers=h).json()["data"]

Reels paginate via max_id. Keep to public, non-personal fields.

What you can collect

Where the public profile exposes them: username, display name, follower/post counts, verification, public post and reel metadata, and engagement counts — plus the username or id you requested. Stick to public, non-personal fields.

Limitations and common challenges

• Most value is gated. Public profiles and their latest posts are reachable, but full post history, comments, stories, and followers sit behind a login — off-limits without crossing ToS and privacy lines.
• The Graph API won't help. Meta's Instagram Graph API serves only your own Business/Creator accounts, not arbitrary public users.
• Heavy rate limiting. Instagram caps unauthenticated requests (~200/hour per IP) and bans datacenter IPs instantly, so DIY needs many rotating residential IPs; a structured API handles that behind one key.
• The user-id hop. Posts and reels are addressed by the numeric user id from the profile, not the @handle.
• Identities are personal data. Usernames, names, and post content are personal under GDPR/CCPA — collect only public, non-personal fields with a lawful basis.

Where this gets used

• Brand monitoring — track public brand and competitor presence. See the brand monitoring use case.
• Creator research — evaluate public creator profiles and reach.
• Trend research — pair with TikTok and YouTube signals.

Sources

Start collecting

Try it first, free: run any public URL through the Free Web Scraper, or check whether a site blocks bots with the Anti-Bot Checker — no signup.

Test the profile endpoint in the Playground, check the schema in the API docs, and review pricing. For a full comparison against other Instagram data APIs, see best Instagram scraper APIs in 2026. See also how to scrape TikTok, how to scrape YouTube, how to scrape LinkedIn, and how to scrape Twitter/X for the rest of the social stack, how to choose a web scraping API, and is web scraping legal.