jackwener/OpenCLI · error · CommandExecutionError

Instagram private route could not derive CSRF token from bro

Error message

Instagram private route could not derive CSRF token from browser session

What it means

The private (internal) Instagram API route requires a CSRF token (csrftoken cookie). The resolver collects it from runtime config, browser cookies, and captured network context; if all are empty this error is thrown instead of sending a doomed request.

Source

Thrown at clis/instagram/_shared/private-publish.js:110

                await page.startNetworkCapture(INSTAGRAM_PRIVATE_CAPTURE_PATTERN);
            }
            await page.goto(`${INSTAGRAM_HOME_URL}?__opencli_private_probe=${Date.now()}`);
            await page.wait({ time: 2 });
            const [cookies, runtime, entries] = await Promise.all([
                page.getCookies({ domain: 'instagram.com' }),
                page.evaluate(buildReadInstagramRuntimeInfoJs()),
                typeof page.readNetworkCapture === 'function'
                    ? page.readNetworkCapture()
                    : Promise.resolve([]),
            ]);
            const captureEntries = (Array.isArray(entries) ? entries : []);
            const capturedContext = derivePrivateApiContextFromCapture(captureEntries)
                ?? derivePartialPrivateApiContextFromCapture(captureEntries);
            const csrfToken = runtime?.csrfToken || getCookieValue(cookies, 'csrftoken') || capturedContext.csrfToken || '';
            const igAppId = runtime?.appId || capturedContext.igAppId || '';
            const instagramAjax = runtime?.instagramAjax || capturedContext.instagramAjax || '';
            if (!csrfToken) {
                throw new CommandExecutionError('Instagram private route could not derive CSRF token from browser session');
            }
            if (!igAppId) {
                throw new CommandExecutionError('Instagram private route could not derive X-IG-App-ID from instagram runtime');
            }
            if (!instagramAjax) {
                throw new CommandExecutionError('Instagram private route could not derive X-Instagram-AJAX from instagram runtime');
            }
            const asbdId = capturedContext.asbdId || '';
            const igWwwClaim = capturedContext.igWwwClaim || '';
            const webSessionId = capturedContext.webSessionId || '';
            return {
                apiContext: {
                    asbdId,
                    csrfToken,
                    igAppId,
                    igWwwClaim,
                    instagramAjax,
                    webSessionId,

View on GitHub (pinned to 49907e53dc)

Solutions

1. Log into Instagram in the automation browser before running the command
2. Visit any instagram.com page first so the csrftoken cookie is set
3. Capture network context (a page load that records headers) before resolving
4. Supply the csrf token explicitly in the instagram runtime config

Example fix

// before
await publishPrivate({ /* no prior session visit */ });
// after
await page.goto('https://www.instagram.com/'); // ensures csrftoken cookie
await publishPrivate({ runtime: { csrfToken: 'ABCDEF123456' } });

const cookies = await context.cookies('https://www.instagram.com');
if (!cookies.some(c => c.name === 'csrftoken')) {
  await page.goto('https://www.instagram.com/'); // establishes csrftoken
}

function hasCsrfToken(rt) {
  return typeof rt?.csrfToken === 'string' && rt.csrfToken.length > 0;
}

try {
  await publishPrivate(cfg);
} catch (e) {
  if (/could not derive CSRF token/.test(e.message)) {
    await page.goto('https://www.instagram.com/'); await reloginIfGuest(); // then retry
  } else throw e;
}

When it happens

Trigger: Calling any private-route publish while no csrftoken cookie exists in the browser session and no capture entry or runtime override supplied a csrfToken.

Common situations: Fresh browser profile never visited instagram.com, session logged out so the cookie is absent, captured traffic purged before resolution.

Related errors

• Instagram story publish could not derive current user id fro
• returned no success evidence
• Failed to save: HTTP ' + r2.status
• HTTP ' + res.status + ' - make sure you are logged in to Ins
• Failed to unfollow: HTTP ' + r2.status

AI-assisted analysis of jackwener/OpenCLI@49907e53dc (2026-08-29). Data as JSON: /api/errors/c6b546032d65943b. Report an issue: GitHub.