jackwener/OpenCLI · error

csrftoken cookie missing - make sure you are logged in to In

Error message

csrftoken cookie missing - make sure you are logged in to Instagram

What it means

Thrown before the create-collection POST is made when the browser's document.cookie contains no csrftoken value. Instagram's private web API requires the CSRF token from this cookie in the X-CSRFToken header, so without it the tool refuses to send a doomed request. It is an early-guard error indicating the browsing session is not logged in or the cookie is inaccessible.

Source

Thrown at clis/instagram/collection-create.js:27

        {
            name: 'name',
            required: true,
            positional: true,
            help: 'Name of the collection to create',
        },
    ],
    columns: ['status', 'collectionId', 'collectionName', 'mediaCount'],
    pipeline: [
        { navigate: 'https://www.instagram.com' },
        { evaluate: `(async () => {
  const name = \${{ args.name | json }};
  if (!name || !String(name).trim()) {
    throw new Error('Collection name cannot be empty');
  }
  const trimmed = String(name).trim();
  const csrf = document.cookie.match(/csrftoken=([^;]+)/)?.[1] || '';
  if (!csrf) {
    throw new Error('csrftoken cookie missing - make sure you are logged in to Instagram');
  }
  const fd = new FormData();
  fd.append('name', trimmed);
  fd.append('module_name', 'collection_create');
  const res = await fetch('https://www.instagram.com/api/v1/collections/create/', {
    method: 'POST',
    credentials: 'include',
    headers: {
      'X-IG-App-ID': '936619743392459',
      'X-CSRFToken': csrf,
    },
    body: fd,
  });
  if (!res.ok) {
    const body = await res.text().catch(() => '');
    throw new Error('Failed to create collection: HTTP ' + res.status + (body ? ' - ' + body.slice(0, 200) : ''));
  }
  const d = await res.json();

View on GitHub (pinned to 49907e53dc)

Solutions

  1. Log in to Instagram in the browser profile used by the automation, then retry
  2. Verify document.cookie contains csrftoken in that same context (open DevTools and check Application > Cookies)
  3. Check you are on the instagram.com domain and not a login/redirect page
  4. Clear stale state and re-authenticate if the session silently expired

Example fix

// before
const csrf = document.cookie.match(/csrftoken=([^;]+)/)?.[1] || '';
if (!csrf) throw new Error('csrftoken cookie missing...');
// after
await page.goto('https://www.instagram.com');
await loginIfNeeded(page); // ensure authenticated session first
const csrf = document.cookie.match(/csrftoken=([^;]+)/)?.[1] || '';
if (!csrf) throw new Error('csrftoken cookie missing...');
Defensive patterns

Strategy: validation

Validate before calling

const hasCsrf = () => /(?:^|;\s*)csrftoken=/.test(document.cookie);
if (!hasCsrf()) throw new Error('Not logged in: csrftoken cookie absent');

Type guard

function hasCsrfCookie(): boolean {
  return document.cookie.split(';').some((c) => c.trim().startsWith('csrftoken='));
}

Try / catch

try {
  await createCollection(name);
} catch (e) {
  if (String(e.message).includes('csrftoken cookie missing')) {
    await loginToInstagram();
    return createCollection(name);
  }
  throw e;
}

Prevention

When it happens

Trigger: Running the collection-create pipeline in a browser context where the csrftoken cookie is absent: not logged in, a freshly cleared/incognito profile, an expired session, or document.cookie not exposing the cookie (e.g. HttpOnly-set variants or wrong domain like a logged-out instagram.com landing page).

Common situations: Developer points the automation at instagram.com before authenticating; session expired overnight; using a fresh browser profile in CI; scraping a page where cookies were blocked or cleared by privacy extensions.

Related errors

AI-assisted analysis of jackwener/OpenCLI@49907e53dc (2026-08-29). Data as JSON: /api/errors/b75614463d0ff962. Report an issue: GitHub.