Getting started

Two things are required: the hashtag, and a session cookie for an Instagram account you control.

Why a session is needed at all

Instagram serves hashtag data only to signed-in requests. There is no logged-out path to it — that is Instagram's decision and not a setting anyone can change.

This actor holds no Instagram accounts and never will. There is no account pool, no credential store and no sign-up automation in it. You supply a session for an account you control, which keeps the account risk with the person who chose the target. Expect the account you use to be rate limited by Instagram and eventually actioned, so use one you are willing to lose.

Getting your session cookie

Only two values are needed. Paste them as one line:

sessionid=<value>; csrftoken=<value>

Where to find them

Open https://www.instagram.com in a browser signed in to the account you want to use.
Open DevTools — F12, or Ctrl+Shift+I (Cmd+Option+I on a Mac).
Go to the Application tab (called Storage in Firefox), then Cookies → https://www.instagram.com.
Copy the Value column for sessionid and for csrftoken.
Paste them into the sessionCookie input in the format above.

Where the two values are. The Value column is blank here because this is a drawing and not a capture of a real session — in your own browser it holds the strings you copy. The ringed tick is why the Console cannot do this job.

Do not use the Console for this

Running document.cookie in the DevTools Console will not work, and will look like it did. sessionid is an httpOnly cookie, so JavaScript cannot read it — the Console returns every other cookie and silently leaves out the only one that matters. You get a long, plausible-looking string that fails with "has no sessionid".

The Application tab shows httpOnly cookies. The Console cannot, by design.

Pasting your whole cookie header also works — extra cookies are accepted and ignored. The input is marked secret, so it is not shown in the run log.

How long it lasts

Instagram issues sessionid with roughly a year of expiry, so it does not need refreshing often. What ends one early is signing out of that browser, changing the account password, or Instagram invalidating it. After that a run fails with "Instagram refused the session" and you copy a fresh value. Do not click Log Out on the browser you took the cookie from.

All the inputs

Input	What it does
`hashtag` string · required	The hashtag to scrape, with or without the leading #.
`resultsLimit` integer · default `100`	Exact ceiling on delivered posts. This actor never delivers or charges for more than this number, whatever a feed page happens to contain.
`onlyPostsNewerThan` string	Stop once the feed reaches this date. Accepts a date (2026-08-01), a datetime, or a relative window (7 days, 3 months). The run STOPS at the date rather than filtering afterwards, so asking for a week costs a week of rows.
`onlyPostsOlderThan` string	Skip posts newer than this date. Combine with the field above to scrape one window.
`sessionCookie` string · required	Two cookies from a browser signed in to an account you control, as `sessionid=…; csrftoken=…`. See Getting your session cookie above. Marked secret, so it is not shown in the run log.
`maxPages` integer · default `50`	Hard ceiling on requests to Instagram, so a very large hashtag cannot page indefinitely.

A first run

The last week of #coffee, at most 200 posts:

{
  "hashtag": "coffee",
  "resultsLimit": 200,
  "onlyPostsNewerThan": "7 days",
  "sessionCookie": "sessionid=…; csrftoken=…"
}

The run stops at the date or the limit, whichever comes first, and you are charged for the rows that reached your dataset.