csrftoken cookie missing - make sure you are logged in to In

Error message

csrftoken cookie missing - make sure you are logged in to Instagram

What it means

Same family as error 1940: thrown when the delete pipeline's browser context has no csrftoken cookie, which is required for the X-CSRFToken header on the delete request. It guards before the collections/list call so the request isn't doomed. Indicates an unauthenticated or cookie-less session.

Source

Thrown at clis/instagram/collection-delete.js:27

        {
            name: 'target',
            required: true,
            positional: true,
            help: 'Collection name (case-insensitive) or numeric collection_id',
        },
    ],
    columns: ['status', 'collectionId', 'collectionName'],
    pipeline: [
        { navigate: 'https://www.instagram.com' },
        { evaluate: `(async () => {
  const target = \${{ args.target | json }};
  if (!target || !String(target).trim()) {
    throw new Error('Collection target (name or id) cannot be empty');
  }
  const raw = String(target).trim();
  const csrf = document.cookie.match(/csrftoken=([^;]+)/)?.[1] || '';
  if (!csrf) {
    throw new Error('csrftoken cookie missing - make sure you are logged in to Instagram');
  }
  const headers = { 'X-IG-App-ID': '936619743392459' };

  // Resolve name -> id via /collections/list/. Always go through this path so we can
  // surface an explicit error on duplicate names or unknown names instead of relying
  // on a 404.
  const listRes = await fetch('https://www.instagram.com/api/v1/collections/list/?collection_types=%5B%22MEDIA%22%5D', {
    credentials: 'include',
    headers,
  });
  if (!listRes.ok) {
    throw new Error('Failed to list collections: HTTP ' + listRes.status + ' - make sure you are logged in to Instagram');
  }
  const listData = await listRes.json();
  const collections = listData?.items || [];
  const isNumericId = /^\\d{6,}$/.test(raw);
  let id = '';
  let resolvedName = '';

View on GitHub (pinned to 49907e53dc)

Solutions

Log in to Instagram in the automation's browser profile and retry
Confirm csrftoken exists via DevTools Application > Cookies for instagram.com
Re-authenticate if the session expired
Ensure the pipeline navigates to https://www.instagram.com before evaluating

Example fix

// before
await page.goto('https://www.instagram.com');
// csrf read immediately
// after
await page.goto('https://www.instagram.com');
await waitForLogin(page); // block until csrftoken cookie exists
// csrf read after

Defensive patterns

Strategy: validation

Validate before calling

const hasCsrf = () => /(?:^|;\s*)csrftoken=/.test(document.cookie);
if (!hasCsrf()) throw new Error('Not logged in: csrftoken cookie absent');

Type guard

function hasCsrfCookie(): boolean {
  return document.cookie.split(';').some((c) => c.trim().startsWith('csrftoken='));
}

Try / catch

try {
  await deleteCollection(target);
} catch (e) {
  if (String(e.message).includes('csrftoken cookie missing')) {
    await loginToInstagram();
    return deleteCollection(target);
  }
  throw e;
}

Prevention

Gate all Instagram automation behind a login check
Use persistent profiles and monitor session expiry
Navigate to instagram.com and confirm authenticated state before evaluating scripts
Disable cookie-blocking extensions in automation profiles

When it happens

Trigger: Browser context not logged into Instagram, expired session, cleared cookies, incognito profile, or document.cookie not exposing csrftoken when the delete pipeline runs.

Common situations: CI running with a fresh profile; overnight session expiry; privacy extensions blocking cookies; pointing the automation at the wrong (logged-out) page state.

Related errors

AI-assisted analysis of jackwener/OpenCLI@49907e53dc (2026-08-29). Data as JSON: /api/errors/09dc4934ae1e7623. Report an issue: GitHub.