{"record":{"id":"c6b546032d65943b","repo":"jackwener/OpenCLI","slug":"instagram-private-route-could-not-derive-csrf-toke","errorCode":null,"errorMessage":"Instagram private route could not derive CSRF token from browser session","messagePattern":"Instagram private route could not derive CSRF token from browser session","errorType":"exception","errorClass":"CommandExecutionError","httpStatus":null,"severity":"error","filePath":"clis/instagram/_shared/private-publish.js","lineNumber":110,"sourceCode":"                await page.startNetworkCapture(INSTAGRAM_PRIVATE_CAPTURE_PATTERN);\n            }\n            await page.goto(`${INSTAGRAM_HOME_URL}?__opencli_private_probe=${Date.now()}`);\n            await page.wait({ time: 2 });\n            const [cookies, runtime, entries] = await Promise.all([\n                page.getCookies({ domain: 'instagram.com' }),\n                page.evaluate(buildReadInstagramRuntimeInfoJs()),\n                typeof page.readNetworkCapture === 'function'\n                    ? page.readNetworkCapture()\n                    : Promise.resolve([]),\n            ]);\n            const captureEntries = (Array.isArray(entries) ? entries : []);\n            const capturedContext = derivePrivateApiContextFromCapture(captureEntries)\n                ?? derivePartialPrivateApiContextFromCapture(captureEntries);\n            const csrfToken = runtime?.csrfToken || getCookieValue(cookies, 'csrftoken') || capturedContext.csrfToken || '';\n            const igAppId = runtime?.appId || capturedContext.igAppId || '';\n            const instagramAjax = runtime?.instagramAjax || capturedContext.instagramAjax || '';\n            if (!csrfToken) {\n                throw new CommandExecutionError('Instagram private route could not derive CSRF token from browser session');\n            }\n            if (!igAppId) {\n                throw new CommandExecutionError('Instagram private route could not derive X-IG-App-ID from instagram runtime');\n            }\n            if (!instagramAjax) {\n                throw new CommandExecutionError('Instagram private route could not derive X-Instagram-AJAX from instagram runtime');\n            }\n            const asbdId = capturedContext.asbdId || '';\n            const igWwwClaim = capturedContext.igWwwClaim || '';\n            const webSessionId = capturedContext.webSessionId || '';\n            return {\n                apiContext: {\n                    asbdId,\n                    csrfToken,\n                    igAppId,\n                    igWwwClaim,\n                    instagramAjax,\n                    webSessionId,","sourceCodeStart":92,"sourceCodeEnd":128,"githubUrl":"https://github.com/jackwener/OpenCLI/blob/49907e53dc3ade5c223ff0c4c2c2785687cec4e6/clis/instagram/_shared/private-publish.js#L92-L128","documentation":"The private (internal) Instagram API route requires a CSRF token (csrftoken cookie). The resolver collects it from runtime config, browser cookies, and captured network context; if all are empty this error is thrown instead of sending a doomed request.","triggerScenarios":"Calling any private-route publish while no csrftoken cookie exists in the browser session and no capture entry or runtime override supplied a csrfToken.","commonSituations":"Fresh browser profile never visited instagram.com, session logged out so the cookie is absent, captured traffic purged before resolution.","solutions":["Log into Instagram in the automation browser before running the command","Visit any instagram.com page first so the csrftoken cookie is set","Capture network context (a page load that records headers) before resolving","Supply the csrf token explicitly in the instagram runtime config"],"exampleFix":"// before\nawait publishPrivate({ /* no prior session visit */ });\n// after\nawait page.goto('https://www.instagram.com/'); // ensures csrftoken cookie\nawait publishPrivate({ runtime: { csrfToken: 'ABCDEF123456' } });","handlingStrategy":"validation","validationCode":"const cookies = await context.cookies('https://www.instagram.com');\nif (!cookies.some(c => c.name === 'csrftoken')) {\n  await page.goto('https://www.instagram.com/'); // establishes csrftoken\n}","typeGuard":"function hasCsrfToken(rt) {\n  return typeof rt?.csrfToken === 'string' && rt.csrfToken.length > 0;\n}","tryCatchPattern":"try {\n  await publishPrivate(cfg);\n} catch (e) {\n  if (/could not derive CSRF token/.test(e.message)) {\n    await page.goto('https://www.instagram.com/'); await reloginIfGuest(); // then retry\n  } else throw e;\n}","preventionTips":["Always log into Instagram in the automation browser before private calls","Visit instagram.com at least once so the csrftoken cookie is set","Keep captured network context intact between login and publish","Pass an explicit csrfToken in runtime config when automating headless"],"tags":["instagram","csrf","session","authentication"],"backgroundTag":"missing-csrf-token","analyzedSha":"49907e53dc3ade5c223ff0c4c2c2785687cec4e6","analyzedAt":"2026-08-29T08:14:47.543Z","schemaVersion":2},"datasetVersion":"2026-08-29T12:17:43.993Z"}