How to Get Instagram Profile Data with an API in 2026

If you need to get Instagram profile data through an API, the shortest integration is a username lookup. GramScraper exposes the endpoint GET /api/instagram/v1/user/by/username. It returns public fields such as the username, display name, biography, follower and following counts, post count, verification state, privacy state, profile picture URL, external URL, and category when those fields are available.

Before you start

Create a GramScraper account, copy the API key from the dashboard, and keep it on your server. New accounts include 100 free credits. A direct profile lookup costs one credit. Current packs are Standard at $29 for 15,400 credits and Business at $300 for 320,000; purchased credits do not expire.

export GRAMSCRAPER_API_KEY="gs_your_api_key"

Test the Instagram profile API with curl

Pass the username without @. The Bearer token belongs in the Authorization header:

curl --get \
  "https://gramscraper.com/api/instagram/v1/user/by/username" \
  --header "Authorization: Bearer $GRAMSCRAPER_API_KEY" \
  --data-urlencode "username=instagram"

Example JSON response

This representative response shows the actual response shape. Counts and text change over time, so treat the values as an example rather than a current profile snapshot.

{
  "username": "instagram",
  "full_name": "Instagram",
  "biography": "Bringing you closer to the people and things you love.",
  "follower_count": 676000000,
  "following_count": 76,
  "media_count": 7892,
  "is_verified": true,
  "is_private": false,
  "profile_pic_url": "https://...",
  "external_url": "https://about.instagram.com",
  "category": "Product/service"
}

Node.js example

Node.js 18 and newer includes fetch. This function validates the response before returning JSON:

const endpoint = new URL(
  "https://gramscraper.com/api/instagram/v1/user/by/username"
);
endpoint.searchParams.set("username", "instagram");

const response = await fetch(endpoint, {
  headers: {
    Authorization: `Bearer ${process.env.GRAMSCRAPER_API_KEY}`,
  },
});

if (!response.ok) {
  const body = await response.text();
  throw new Error(`GramScraper ${response.status}: ${body}`);
}

const profile = await response.json();
console.log({
  username: profile.username,
  followers: profile.follower_count,
  verified: profile.is_verified,
});

Python example

Install requests with python -m pip install requests, then send the same request:

import os
import requests

response = requests.get(
    "https://gramscraper.com/api/instagram/v1/user/by/username",
    headers={
        "Authorization": f"Bearer {os.environ['GRAMSCRAPER_API_KEY']}"
    },
    params={"username": "instagram"},
    timeout=20,
)
response.raise_for_status()

profile = response.json()
print({
    "username": profile.get("username"),
    "followers": profile.get("follower_count"),
    "verified": profile.get("is_verified", False),
})

Get Instagram profile data without login

The flow above deliberately requires no Instagram login. Your application never stores an Instagram password, never holds a session cookie, and never inherits the account-level risk that comes with either. Authentication happens once, on your side of the boundary, and it is a GramScraper API key rather than an Instagram account.

That matters because most self-built scraper failures are session failures. The three families you would otherwise have to diagnose are covered separately:

• Login required errors — an auth wall that a logged-out request cannot pass.
• Blocked, challenge_required, and checkpoint_required — account-level blocks that a retry loop makes worse.
• Rate limits and “too many requests” — throttling that no session alone solves.

The endpoint returns publicly available fields only. A private profile will not expose its content through an API key, and no credential you hold changes that: retrieving non-public data is a permissions question, not a scraper configuration question.

Handle errors in production

Do not assume every request succeeds. A 401 normally means the API key is missing or invalid, 402 means the account needs credits, and 404 means the profile was not found. Treat 429 and 5xx responses as retryable only when appropriate, use exponential backoff with jitter, cap retries, and log the response status.

For the related failure modes this endpoint removes, see the web_profile_info guide, why GraphQL query hashes change, and useragent mismatch responses. For a tooling comparison, see the Instaloader 429 alternative.

Also expect optional fields. Use null-safe access and store the response timestamp if you compare profile metrics later. For more endpoints—including posts, reels, stories, highlights, hashtags, comments, and locations—see the API documentation.