Connect your Instagram Business account - no Facebook Page required - and let Ashley draft, publish and analyse posts, carousels and Reels. Three scopes, nothing more.
Connect the account you actually post from - not a Facebook Page you had to invent.
Unyo connects to Instagram through Business Login for Instagram. That means you sign in with your Instagram Business or Creator account and you're done. No Facebook Page. No Business Manager. No linking two accounts together and hoping the token survives.
Most tools still force the legacy bundled flow, where Instagram access rides on a Facebook Page grant. Unyo runs two separate Meta apps and two independent OAuth flows - one for Instagram, one for Facebook Pages. Connect either. Connect both. Neither depends on the other.
You need a Business or Creator account
Instagram's publishing API only works with Business and Creator accounts - that's Meta's rule, not ours. A personal account can be switched to Creator for free in the Instagram app (Settings → Account type and tools). If you try to publish from a personal account, Unyo tells you exactly that instead of failing silently.
What it unlocks
Once Instagram is connected, here's what changes - concretely, per agent.
Ashley - your social media manager
- Ask for a post, get a finished draft card. Caption, hashtags and a generated image arrive together in the chat, on an editable card with per-platform preview tabs. You don't need Instagram connected to draft - only to publish.
- Real native carousels, 2 to 10 images. Not a link dump and not a grid collage: Unyo builds true child containers, assembles the carousel parent, then publishes it - Instagram's actual API flow. Ask for a carousel and you get one; ask for a post and you get exactly one image (Ashley is instructed never to invent a carousel you didn't ask for).
- Edit the images by talking. "Make it brighter" edits image 2 in place. "Add another one" appends a style-coherent shot using the previous image as reference. "I hate it, redo it" replaces it.
- Publish with one tap from the card. Select Instagram (and Facebook, LinkedIn, X if you want) and hit publish. You get the real permalink back.
- Schedule from the card, in your own timezone. The scheduler picks the job up within the minute of its due time, with retries on transient failures and a hard cancel guard.
- Your real numbers, never invented benchmarks. Followers and growth, reach, impressions, profile visits, engagement rate, average likes and comments. Best hour and best day to post - computed from your posts' engagement, not an industry blog. Hashtag rankings that only count tags you've actually used.
- Top posts, with per-post metrics. Likes, comments, reach, impressions, saves, shares. Instagram and Facebook are the only two platforms whose APIs expose this - Unyo tells you that plainly rather than pretending.
Every other agent
Instagram data lives in your Neural Core, so it isn't locked inside Ashley's chat. Every agent reads the same memory. Ask Blake about the numbers, ask Lucy to turn your best-performing post into an article - they can see the same context Ashley does.
Ashley can't touch your inbox, and Maya can't touch your Instagram
Each agent has a hard-enforced toolbox - a runtime access control, not a prompt instruction. Ashley is denied every email tool. Maya is the only agent with your inbox. The boundary holds even if a model decides to be creative.
How to connect
- Open Integrations from the sidebar. (It's a top-level page - not inside Settings.)
- Find the Instagram card under the Social filter, and click Connect.
- Sign in with your Instagram Business or Creator account.
- Review the three permissions Instagram shows you, and approve.
- You land back on Integrations with the card showing your @handle.
If an agent needs Instagram mid-conversation and you haven't connected it yet, you get a Connect card right in the chat. It takes you straight into the flow, and when you come back the run picks up where it left off - no retyping.
Permissions - what Unyo asks for, and what it deliberately doesn't
Unyo requests three Instagram permissions. That's the whole list.
| Permission | What it lets Ashley do, in plain English |
|---|---|
instagram_business_basic | Read your profile and your follower count - that's how the card shows your @handle and how growth is tracked. |
instagram_business_content_publish | Publish a post, a carousel or a Reel - only when you tap publish or when a job you scheduled comes due. |
instagram_business_manage_insights | Read the insights Instagram exposes for your account and your posts: reach, impressions, profile visits, saves, shares. |
Deliberately not requested
These exist. Unyo does not ask for them.
| Permission we skip | What it would have given us |
|---|---|
instagram_business_manage_comments | Reading and replying to the comments on your posts. |
instagram_business_manage_messages | Reading and sending your Instagram DMs. |
Unyo cannot read a single one of your Instagram DMs or comments, because it never asked for the ability to. Not "we choose not to" - the grant doesn't exist. If we ever build a feature that needs it, you'd see a new consent screen and you could say no.
The same discipline runs across the platform: 9 Google scopes were cut to 5, mail.google.com was dropped entirely, and Shopify is read-only by grant (all 7 scopes are read_*).
What Unyo does with your data
- Your access token is encrypted at rest. It goes through a database-level encryption function on the way in and out - it is never written to or read from a plain column. As of 16 July 2026, all 17 populated OAuth token columns across the platform were verified AES-256 encrypted at the cipher-byte level. Zero plaintext tokens exist.
- The token is never logged, never put in a queue payload, never returned in an error message. It's resolved transiently, used to make one call to Instagram, and dropped.
- Every call to Meta is signed with
appsecret_proof- an HMAC of your token with our app secret, appended to every single server-side request. It's a CASA Tier 2 requirement that most integrations skip. - Your row is yours. Row-level security scopes every connection to your user id - 109 of 109 public tables have RLS, verified live on 16 July 2026.
- No training. Every model Unyo runs is under a no-training, zero-retention guarantee. Your captions, your insights and your images are used to do the thing you asked for, and nothing else.
- Deleting your account purges it all. Around 80 tables, atomically.
Your token refreshes itself
Instagram long-lived tokens last 60 days. A daily job rolls yours over before it can lapse. If a refresh ever fails, the card flips to Reconnect required with a button - you find out from the card, not from a post that silently didn't go out.
Example prompts
Write me an Instagram post announcing our new summer menu. Warm, a bit playful, with a photo of an iced coffee on a terrace.
Make me a 5-image carousel showing the steps of our croissant process. Same visual style across all five.
Publishing - the rules Instagram enforces, and the ones we do
- A post needs an image. Instagram has no text-only post. Unyo tells you before you waste a tap.
- Up to 10 images per carousel. The editor lets you go to 10 and reorder them by dragging.
- Caption limit: 2,200 characters. Hashtag limit: 30. The composer counts against the real limits live.
- Nothing publishes by itself. Publishing requires you, signed in, tapping the button - or a job you personally scheduled. There is no autonomous publishing code path anywhere in Unyo. When an agent runs on a schedule, it prepares the draft fully and stops.
- Voice can draft, voice cannot publish. Talk to Ashley and a draft card appears while you speak. To publish it, you tap. That boundary is deliberate.
- Click twice, post once. Every publish job is keyed by a SHA-256 of its content, platforms and schedule time. A double-tap or a retried flaky request returns you the existing job, not a duplicate post.
- A partial failure is reported as one. Publish to Instagram and LinkedIn at once and Unyo fans them out in parallel - if LinkedIn fails, the Instagram permalink still comes back, and the job is marked partial with a reason.
Ask Ashley to schedule it - but confirm it on the card
Scheduling is done from the Schedule button on the draft card, where you pick the date, time and timezone. Talking to Ashley about scheduling is not the same as a scheduled job existing. If you want it queued, use the card - then ask "what's scheduled?" to see the queue.
Reels can be published to Instagram from a video, using the same content_publish permission. Instagram refuses Reels from personal accounts.
Disconnecting and revoking - the honest version
Disconnect is on the Instagram card in Integrations. It deletes your connection row from Unyo: the token, the account id, the link. Unyo can no longer reach your Instagram, immediately.
Unyo cannot revoke your Instagram grant for you
Meta exposes no programmatic revocation endpoint for Business Login for Instagram. There is no API call we could make on your behalf, so we don't pretend there is one. When you disconnect, Unyo hands you a direct link to instagram.com/accounts/manage_access so you can finish the job at the source, where Meta keeps the record.
Deleting your Unyo account behaves the same way for Instagram: the row is purged and the grant is yours to remove at Meta. For every provider that does offer a revocation endpoint, account deletion calls it.
If you revoke Unyo from Instagram's own settings instead, the card updates itself immediately - Unyo listens for the change and flips Connected → Connect without you refreshing the page.
Troubleshooting
"Reconnect required" on the Instagram card. The 60-day token couldn't be refreshed - usually because access was removed at Meta, or the account changed. Click Connect and sign in again. Your drafts, scheduled posts and analytics history are untouched.
Publishing is refused with an account-eligibility error. The account is personal. Switch it to Business or Creator in the Instagram app (Settings → Account type and tools), then reconnect.
"An image is required." Instagram doesn't support text-only posts. Ask Ashley for an image, pick one from your library, or attach your own.
The connect window doesn't finish. Allow pop-ups for the sign-in window and try again. The sign-in link expires 10 minutes after you start, so if you left it open overnight, start over from the card.
Analytics look stale. Insights are cached and refresh themselves when they're more than 6 hours old - asking for them triggers a live re-sync. If a number is missing, it's because Instagram's API doesn't expose it for your account, and Ashley will say so rather than invent it.
My Facebook Page disconnected and Instagram broke. It didn't, and it can't. They're two independent connections through two separate apps. Disconnecting one never touches the other.
FAQ
Do I need a Facebook Page to connect Instagram?
No. Unyo uses Business Login for Instagram, which authenticates your Instagram Business or Creator account directly. Instagram and Facebook are two separate connections through two separate Meta apps - you can connect either one, both, or neither. Most tools still bundle them; Unyo dissociated them deliberately.
Can Unyo read my Instagram DMs or comments?
No - and not by policy, by construction. The permissions that grant DM and comment access (instagram_business_manage_messages and instagram_business_manage_comments) are deliberately not requested. Unyo asks for exactly three things: your basic profile, the ability to publish when you tap publish, and read access to your insights.
Will Ashley post something without me approving it?
No. Publishing requires you to tap publish on the card, or a job you scheduled yourself coming due. There is no unattended publishing path in Unyo at all - when an agent runs on a schedule while you're offline, it prepares the draft and stops. Even by voice, Ashley can draft but cannot publish; you tap the card.
Can Unyo revoke my Instagram access when I disconnect?
Not at Meta's end - Instagram exposes no revocation endpoint, so no tool can do this for you programmatically. What Unyo does is delete your connection row immediately, which cuts off its own access, and hand you the direct link to Instagram's manage-access page so you can remove the grant at the source. We'd rather tell you that than let you assume it happened.
How many images can a carousel have, and are they real carousels?
Two to ten, and yes - Unyo builds Instagram's actual carousel: individual child containers, a carousel parent, then publish. Not a collage, not a link. The editor lets you drag to reorder before it goes out.
Is my Instagram data used to train an AI model?
No. Every model Unyo runs is under a no-training, zero-retention guarantee. Your access token is encrypted at rest and never appears in a log, an error message or a queue payload. Deleting your account purges every connection row.
Related: Facebook · Social publishing · Social analytics · Ashley · Security & privacy