Instagram error 190: Session invalidated - password changed or session revoked

Subcode 460 means the token did not age out - it was killed. Facebook invalidates every session belonging to a user when that user changes their password, logs out of all sessions, or when Meta's security systems decide the session is at risk (suspicious login, checkpoint, credential found in a breach corpus). Every token derived from that session dies with it, including the Page access token your Instagram bot messages with.

This is the human-shaped token failure, and it is why Instagram integrations break on days when nothing was deployed. A social media manager changes their Facebook password after a phishing scare; an employee who originally connected the account leaves and IT resets their credentials; someone clicks "log out of all devices." The integration they authorized months ago stops within minutes. Unlike 463, no refresh schedule can prevent it - the session the tokens hang from no longer exists.

The only recovery is a fresh login by someone with access to the linked Facebook Page (or the Instagram account, on the Instagram Login route). Nothing about the app, the webhook subscription, or the account link is damaged; they all resume the moment a valid token exists again.

{
  "error": {
    "message": "Error validating access token: The session has been invalidated because the user changed their password or Facebook has changed the session for security reasons.",
    "type": "OAuthException",
    "code": 190,
    "error_subcode": 460,
    "fbtrace_id": "Gh5jK2lM9nPq"
  }
}

Reduce the blast radius of any one person's credentials: have the connection authorized by an account that is durable (a role account or the business owner, not whichever employee was at the keyboard), document who it was, and treat password changes on that account as an operational event. Detect the failure fast - alert on the first 190 rather than the thousandth - and make your reconnect flow a one-click path you can send to the account owner. The worked-yesterday triage order for token failures is in the Instagram troubleshooting guide, and the sibling failure modes are under the 190 hub entry.