jackwener/OpenCLI · error · Error

Failed to comment: HTTP ' + r2.status

Error message

Failed to comment: HTTP ' + r2.status

What it means

The POST to /api/v1/web/comments/{pk}/add/ returned a non-ok HTTP status, so the CLI throws 'Failed to comment: HTTP <status>'. The comment was not accepted at the transport level (auth, permissions, or rate limiting), distinct from in-body status failures.

Source

Thrown at clis/instagram/comment.js:63

  }
  function assertOkStatus(payload, label) {
    if (!payload || typeof payload !== 'object' || payload.status !== 'ok') {
      throw new Error(label + ' returned no success evidence');
    }
  }

  // web_profile_info answers HTTP 400 for business accounts; feed-by-username needs no user id. See #2234.
  const r1 = await fetch('https://www.instagram.com/api/v1/feed/user/' + encodeURIComponent(username) + '/username/?count=' + (idx + 1), opts);
  if (!r1.ok) throw new Error(r1.status === 404 ? 'User not found: ' + username : 'HTTP ' + r1.status + ' - make sure you are logged in to Instagram');
  const { pk } = getPostFromFeed(await readInstagramJson(r1, 'Instagram feed-by-username'), 'Instagram feed-by-username');

  const csrf = document.cookie.match(/csrftoken=([^;]+)/)?.[1] || '';
  const r2 = await fetch('https://www.instagram.com/api/v1/web/comments/' + pk + '/add/', {
    method: 'POST', credentials: 'include',
    headers: { ...headers, 'X-CSRFToken': csrf, 'Content-Type': 'application/x-www-form-urlencoded' },
    body: 'comment_text=' + encodeURIComponent(commentText),
  });
  if (!r2.ok) throw new Error('Failed to comment: HTTP ' + r2.status);
  assertOkStatus(await readInstagramJson(r2, 'Instagram comment'), 'Instagram comment');
  return [{ status: 'Commented', user: username, text: commentText }];
})()
` },
    ],
});

View on GitHub (pinned to 49907e53dc)

Solutions

1. Check the csrftoken cookie is present and passed as X-CSRFToken; re-login if missing
2. Reduce comment frequency and vary text to avoid 400/429 spam throttling
3. Confirm the target post allows comments
4. Re-send with full browser-like headers (X-IG-App-ID, X-Requested-With, Referer) if IG tightened checks

Example fix

// before
if (!r2.ok) throw new Error('Failed to comment: HTTP ' + r2.status);
// after
if (!r2.ok) {
  const body = await r2.text().catch(() => '');
  if (r2.status === 403 && !csrf) throw new Error('Comment failed: missing csrftoken - re-login');
  throw new Error('Failed to comment: HTTP ' + r2.status + (body ? ' - ' + body.slice(0, 200) : ''));
}

const csrf = document.cookie.match(/csrftoken=([^;]+)/)?.[1] || '';
if (!csrf) throw new Error('No csrftoken cookie - re-login before commenting');

function canComment(csrf, cookies) {
  return typeof csrf === 'string' && csrf.length > 0 && cookies.includes('sessionid');
}

try {
  await runCommentPipeline(args);
} catch (e) {
  const m = /Failed to comment: HTTP (\d+)/.exec(e.message);
  if (m) {
    if (m[1] === '403') console.error('CSRF/auth problem - re-login');
    else if (m[1] === '429' || m[1] === '400') console.error('Throttled - back off and vary comment text');
  } else throw e;
}

When it happens

Trigger: Missing/invalid CSRF token (403); session expired (401/403); comments disabled on the target post (often 403); spam/rate limiting (429 or 400); post deleted between fetch and comment (404).

Common situations: csrftoken cookie absent because login state is broken; automation posting identical comments rapidly; commenting on very old posts with comments turned off; IG hardening web endpoints requiring extra headers.

Related errors

• Instagram private route could not derive CSRF token from bro
• Instagram returned non-ok status: ${JSON.stringify(d).slice(
• returned no success evidence
• User not found: ' + username (or 'HTTP ' + r1.status + ' - m
• Failed to follow: HTTP ' + r2.status

AI-assisted analysis of jackwener/OpenCLI@49907e53dc (2026-08-29). Data as JSON: /api/errors/1cda414ffab12371. Report an issue: GitHub.