Instagram error 190: Invalid OAuth access token

Code 190 is the Graph API's umbrella token failure: the credential on the request is expired, revoked, malformed, or otherwise not a live session. It is raised by Graph API authentication before any Instagram messaging logic runs, so nothing about your payload, recipient, or window is being evaluated. Meta's guidance for the base code is simply "Get a new access token."

The error_subcode carries the diagnosis. 463 is expiry, 460 is a password change or security invalidation, 467 is a token that was revoked or is otherwise invalid, 458 means the user has not logged into the app. Without a subcode, suspect the mundane causes first: a truncated or empty token variable, a token for the wrong app or wrong route (Instagram-Login token against Page endpoints), or a placeholder that survived from a code sample.

On Instagram the practical rule is that inbound webhooks keep flowing while 190 blocks every outbound call, because webhook delivery does not authenticate with your token. If both directions are dead, you likely have a subscription or toggle problem instead - see the webhook debugging guide.

Never let a token be an anonymous string: store its type, issuing user, scopes, and expiry next to it, refresh long-lived tokens on a monitored schedule, and fail deployment if the configured token is invalid at boot. Alert on the first 190 in production - every hour of delay is an hour of silent non-delivery. The subcode-by-subcode fixes are under 190/463 and 190/460, and the lifecycle is walked through in the troubleshooting guide.