Instagram error 10: Application does not have permission for this action

Bare code 10 - no subcode, or a subcode other than the window family - means the Graph API refused the call because the token you presented was never granted the permission this endpoint requires, or your app holds the permission at the wrong access level. For Instagram messaging on the Messenger Platform route the critical scope is instagram_manage_messages on a Page access token; on the Instagram Login route it is instagram_business_manage_messages. Mixing the two routes produces exactly this error: an Instagram-Login token used against Page-based endpoints has none of the Page-route permissions, and vice versa.

Access level matters as much as the grant. Standard Access - what every app has before review - only works for people with a role on the app. Serving the public requires Advanced Access for the messaging permission, which means App Review and, for most apps, Business Verification. An app that works for its developers and returns (#10) or silence for customers is almost always still at Standard Access or in Development mode (that variant usually surfaces as code 200).

Read the message string before fixing anything: code 10 with subcode 2534022 is the 24-hour window, a different problem with a different fix. The permission form never mentions hours.

{
  "error": {
    "message": "(#10) Application does not have permission for this action",
    "type": "OAuthException",
    "code": 10,
    "fbtrace_id": "AxY9zW7vU5tS"
  }
}

Pin the scope list in one place in code and assert on the granted scopes at connect time: inspect the token immediately after login and refuse to store it if the messaging permission is absent, so the failure happens during onboarding instead of on the first customer message. Keep the two API routes strictly separated in configuration. The full permission matrix and access-level requirements are covered in section 5 of the Instagram troubleshooting guide, and the account prerequisites in the limits reference.