Frequently asked questions

Is igpapi an Instagram private API library?

Yes. igpapi is the Instagram private API Simulator for Node.js: it uses the same private API the Instagram app uses. That is why it simulates the app (the same phone signals, headers, order of requests and pauses) instead of calling endpoints bare (How the Simulator works).

What happened to the Instagram private API SDK?

It is this library, renamed. The Node.js Instagram private API SDK is now the igpapi Simulator, rebuilt around the screens a person walks in the app (Upgrading lists what changed between releases).

How do I get a licence or a token?

Write to the author: email dilame.bowzee@gmail.com, or Telegram @bowzee. A licence gives your GitHub account read access to the @igpapi packages and an IGPAPI_LICENSE_TOKEN (Get access and install).

How do I report a problem?

Write to the same address: email dilame.bowzee@gmail.com, or Telegram @bowzee. Send the error's tag, the page you followed, and the program, with the account's secrets removed.

Can I do mass likes, follows, comments or direct messages with the Simulator?

The Simulator is an up-to-date client, not an anti-ban solution. It handles the low-level work (the phone, the signatures, sessions, telemetry), but whether an account survives heavy automation depends on your own strategy: pacing, proxy rotation, warm-up, content patterns (Account safety and pacing). Most users build posting tools, direct-message bots, live-streaming setups and analytics, not spam. If you plan to push hard, you are responsible for not getting your accounts killed.

Do I get the source code?

The source of the platform packages, the screens and these guides is public, at github.com/igpapi/igpapi: the public mirror of the project. The core package is closed and ships as an obfuscated build.

How many accounts can one process or one machine run?

One entry call runs one account in one app process, and a process shares no state with another. Several accounts run side by side on one machine as several calls, one per account. Give each account its own seed and, ideally, its own proxy.

Can I run many accounts in parallel?

Yes: one entry call per account, started side by side (for example with Promise.all). Each call has its own phone, session and connections.

Why does my program need a session file?

So the account is not logged in on every run. A login on every run looks like a new device logging in each time. Log in once, store the checkpoint, and launch it afterwards (Keep a session).

What happens if Instagram changes the app?

The Simulator follows the current Instagram app. When the app changes what it sends, a release of the Simulator changes with it, as a minor version if the change breaks a program (Upgrading). Update the packages, and launch your stored sessions with the new release.

Can the Simulator solve captchas?

No. A reCAPTCHA screen gives your program the site key (screen.data.siteKey); a solving service you bring returns the token, and submitRecaptcha(token) sends it (Challenges: answer them once with otherwise).

Does it work with SMS two-factor?

Not through the two-factor screens, which act on the authenticator app and on an approval on another device. Turn on the authenticator app for the account, or finish the login with the app-layer effects (Log in).

Is it backward-compatible with earlier versions?

No. Version 4 is a rewrite on top of Effect: state management, error handling and the runtime API all changed. Method names for most endpoints stayed close to the previous versions, but everything is wrapped in Effect now, and session and state handling works differently. Migration needs rework but not a full rewrite. For the changes between 4.x releases, see Upgrading.

Which Node.js versions are supported?

Node.js 22 and newer, with TypeScript 7 or newer (Get access and install).

Does it work in the browser, on edge runtimes, in Bun or in Deno?

No. The Simulator relies on Node-specific crypto, networking and native transport bindings.

Which platform should I choose, Android or iOS?

Android. The Android package is the priority direction and has the screens, the process entries and the guides on this site. The iOS package is not the priority direction and is implemented less exhaustively than the Android one.

Where do I keep the account's password and the authenticator key?

In your own secret storage, read from the environment at run time. A session checkpoint also contains credentials (the session's authorization and cookies, the phone's private identifiers): store it as a secret, never log it, and hand it only to the process that continues it (Keep a session).