Instagram API with Instagram Login

How the login works

The person starts at the app's authorization URL on instagram.com, approves the requested permissions and is sent back with an authorization code that is valid for one hour. The app exchanges it for a short-lived token, also valid for one hour, and then for a long-lived token valid for 60 days. A long-lived token can be refreshed once it is at least 24 hours old and still valid. Tokens that are not refreshed within 60 days expire.

Permissions a comment-to-DM tool needs

instagram_business_basic reads the profile and media, instagram_business_manage_comments reads and answers comments and sends private replies, and instagram_business_manage_messages sends and receives DMs. Apps that serve accounts their developer does not own or manage need Advanced Access for these, which requires Meta's App Review and Business Verification.

Compared with Facebook Login

The other setup, the Instagram API with Facebook Login, needs the Instagram account linked to a Facebook Page, uses Facebook credentials and runs on graph.facebook.com. Messaging there goes through the Messenger Platform. For creators without a Page, the Instagram Login setup is the shorter path, and it is the one Elevion uses, so nobody shares a password with Elevion.

Sources