How to Scrape Instagram Followers (2026)

I build Instagram data pipelines for a living, and a follower list is the request that trips people up fastest. A profile scrape is easy: one call returns the follower count. Pulling the actual list of accounts behind that number is a different job, because Instagram never puts the roster on the public page and the official API refuses to hand it over.

This guide on how to scrape Instagram followers is the version I wish existed when I started: what the count-versus-list distinction actually means, the Python I tested against live public accounts in July 2026, the login gate you hit on the follower endpoint, and the managed route that returns the roster as JSON. Every status code and field here is what I saw on my own screen.

What does it mean to scrape Instagram followers in 2026?

Scraping Instagram followers in 2026 means reading the follower roster, the list of accounts that follow a profile, not just the follower count Instagram prints on the page. Those are two different pieces of data, and the gap between them is the whole reason this is harder than it looks.

The follower count is a single public number. It sits in the profile JSON, it shows on the page, and any profile scrape returns it. The follower roster is the set of usernames, ids, and names behind that number, and Instagram treats it as a separate, gated resource that no public page and no official endpoint exposes in full.

Here are the four routes to that roster, and what each one actually returns:

The first two rows give you the count and stop there. The third row is the only direct route to the actual list, and it comes with a login requirement that shapes everything downstream. The fourth hands the whole problem to a server. Before any code, it helps to see exactly where that login gate sits.

Can you scrape Instagram followers without logging in?

You can read a profile’s follower count without logging in, but you cannot pull the full follower list without a logged-in session, because Instagram serves the roster only through app endpoints that require authentication. This is the single fact that decides how a follower scrape is built.

The official API confirms the limit from the top. The Instagram Graph API IG User node exposes a followers_count field and a handful of other profile numbers, and there is no edge anywhere in it that returns the accounts behind that count. So the one piece of data a follower scraper exists to deliver is the one piece the official API will not give you.

The logged-out web surface is no different. Instagram’s public web_profile_info endpoint returns the profile as JSON, including the follower count and the user id, but not the follower roster. To read the roster you call Instagram’s app endpoint, friendships/{user_id}/followers/, and that endpoint answers a logged-out request with a login or checkpoint wall instead of data. A logged-in session is the price of entry, which is exactly where the Python route starts.

How do you scrape Instagram followers with Python?

You scrape Instagram followers with Python in two steps: resolve the username to a numeric user id, then page the follower roster from Instagram’s app endpoint with an authenticated session. The first step works logged out, the second does not, and keeping them separate is what makes the code readable.

Step 1: resolve the username to a user id. The friendships endpoint keys off the numeric user id (the pk), not the username, so you fetch the profile first. A plain requests call is refused at the TLS layer with a 429, so I use curl_cffi to match a real Chrome fingerprint, which returns the profile JSON on a clean IP:

from curl_cffi import requests as creq

username = "nasa"
url = f"https://i.instagram.com/api/v1/users/web_profile_info/?username={username}"
headers = {"x-ig-app-id": "936619743392459"}   # the public web client app id

r = creq.get(url, headers=headers, impersonate="chrome", timeout=20)
user = r.json()["data"]["user"]
user_id = user["id"]
print(user_id, user["edge_followed_by"]["count"])   # numeric pk, then the follower count

Step 2: page the follower roster. With the user id in hand, you call friendships/{user_id}/followers/ and walk the next_max_id cursor until it runs out. This endpoint needs a valid sessionid cookie from a logged-in account, and each page returns roughly 50 followers:

from curl_cffi import requests as creq
import time

SESSIONID = "PUT_A_LOGGED_IN_SESSION_COOKIE_HERE"   # the follower list needs auth
user_id = "528817151"
headers = {"x-ig-app-id": "936619743392459"}
cookies = {"sessionid": SESSIONID}

followers, max_id = [], ""
while True:
    url = (f"https://i.instagram.com/api/v1/friendships/{user_id}/followers/"
           f"?count=50&max_id={max_id}")
    r = creq.get(url, headers=headers, cookies=cookies, impersonate="chrome", timeout=20)
    data = r.json()
    for u in data.get("users", []):
        followers.append((u["username"], u["full_name"], u["is_verified"]))
    max_id = data.get("next_max_id")
    if not max_id:            # cursor is empty on the last page
        break
    time.sleep(4)            # pace requests to stay under the rate gate
print(len(followers))

The sessionid is the catch, and it is a real risk. A logged-in account moving through follower pages fast draws a challenge_required checkpoint, and a flagged account can hit an action block or a ban, so use a throwaway account you can afford to lose. Private targets return nothing regardless of the session, because a private roster is closed to accounts the owner has not approved.

How do you scrape a following list?

You scrape a following list by swapping the resource path from followers to following: friendships/{user_id}/following/. The response shape, the users array, and the next_max_id cursor are identical, so the exact same loop pages the accounts a target follows. The following list carries the same authentication requirement, so it needs the logged-in session too. Both lists share one more constraint that no session removes, which is Instagram’s rate ceiling.

How many followers can you scrape before Instagram blocks you?

You can scrape roughly a few hundred followers per hour per IP before Instagram blocks you with a 429 or a checkpoint, because the follower endpoint sits under the same rate ceiling as every other call, near 200 requests per hour per IP. The Scrapfly 2026 Instagram guide puts the non-authenticated ceiling at that same figure, and the follower roster does not get a higher budget for being paginated.

The arithmetic is what surprises people. Each follower page returns about 50 accounts, so a 200,000-follower roster needs roughly 4,000 paged calls to read in full. At 200 requests per hour that is a full day of continuous requests from a single IP, which is far past what one address survives before the checkpoint lands. Reading a large roster means spreading those calls across a pool of IPs, not hammering one.

These are the levers that moved the result in my testing, in rough order of impact:

• Use residential IPs. Datacenter ranges are refused on sight. A residential IP presents as an ordinary home connection and clears the first gate.
• Hold a sticky session per IP. Switching IP mid-roster kills the max_id cursor and returns empty results with no error. Keep one IP for the whole paginated sequence.
• Slow the cadence. A steady request every few seconds survives longer than a burst. The time.sleep in the loop above is load-bearing, not decoration.
• Keep the logged-in account disposable. The sessionid raises the ceiling and raises the stakes. A flagged account can be blocked or banned, so never use one that matters.

Doing all of this yourself, the residential pool, the sticky sessions, the throwaway accounts, and the retries on every soft block, becomes a standing project once you pass a few thousand followers. I go deeper on the block behavior and the warning signs in my guide on how to avoid getting blocked scraping Instagram. The alternative is to hand the session and pagination work to a server.

How do you scrape Instagram followers at scale without managing sessions?

You scrape Instagram followers at scale by sending one request to a scraper API that manages the logged-in session, the residential proxies, the max_id pagination, and the retries on its servers, then returns the follower roster as parsed JSON. This removes the two parts of the Python route that break in production: the account you keep getting banned and the cursor you keep babysitting.

The request is a single authenticated GET with the target username:

curl "https://chocodata.com/api/v1/instagram/followers?username=nasa&api_key=$CHOCO_API_KEY"

The Python version is the same shape, and it returns each follower as a structured record you can drop straight into a pipeline, with the pagination handled on the server side:

import requests, os

resp = requests.get(
    "https://chocodata.com/api/v1/instagram/followers",
    params={"username": "nasa", "api_key": os.environ["CHOCO_API_KEY"]},
    timeout=30,
)
for follower in resp.json()["followers"]:
    print(follower["username"], follower["full_name"], follower["is_verified"])

In my runs this returned the full follower and following lists as JSON, each follower carrying the username, user id, full name, and verified flag, without a sessionid, a proxy, or a cursor on my side. The endpoint calls the gated app API correctly and reports an honest auth status when a target is walled rather than inventing a feed, and because it bills only successful requests, calls that hit the login gate are not charged. You can start on the ChocoData free tier of 1,000 requests without a card.

Which method should you choose?

The right method depends on whether you need the count or the list, the volume, and how much account risk you want to carry.

If you would rather compare managed follower tools head to head instead of writing the session handling yourself, I ranked six of them in my best Instagram follower scrapers in 2026 roundup. One limit applies to every option in that table, though, and it is worth stating plainly before you run anything: the account has to be public.

Can you scrape followers from a private Instagram account?

No, you cannot scrape followers from a private Instagram account, because a private profile’s follower list is visible only to followers the account has already approved. No API, tool, or session reads a private roster without an approved connection, and a scrape against a private target returns zero followers. Every method in this guide works on public accounts only.

There is a legal line to settle before any large follower pull, because a follower list is personal data. On the platform side, Meta Platforms v. Bright Data (January 2024) held that Meta’s terms do not bar logged-off scraping of public data, since a logged-out scraper never agrees to those terms, a ruling specific to public data that does not touch private content.

That ruling does not clear the privacy side. The French regulator CNIL’s legitimate-interest focus sheet states there is no blanket exception for publicly available data under the GDPR, and it treats respecting a site’s rules as a factor in whether scraping is lawful. None of this is legal advice. Collect only public follower data, respect the platform’s limits, and handle any personal data you keep under the law that applies to you. For the wider field beyond followers, I rank every managed option in my best Instagram scrapers in 2026 roundup.

Sources

• Instagram Graph API IG User node - documents the followers_count field and the absence of any follower-list edge - https://developers.facebook.com/docs/instagram-platform/instagram-graph-api/reference/ig-user
• Scrapfly, How to Scrape Instagram in 2026 - the ~200 requests/hour/IP anonymous ceiling and that the Graph API never returns follower lists - https://scrapfly.io/blog/posts/how-to-scrape-instagram
• curl_cffi - browser TLS/JA3 impersonation used to clear the profile-resolve 429 - https://github.com/lexiforest/curl_cffi
• Meta Platforms v. Bright Data (January 2024) - logged-off scraping of public data not barred by Meta’s terms - https://www.courthousenews.com/federal-judge-rules-against-meta-in-data-scraping-case/
• CNIL legitimate-interest focus sheet - no blanket GDPR exception for publicly available data - https://www.cnil.fr/en/legal-basis-legitimate-interest-focus-sheet-measures-implement-case-data-collection-web-scraping