Instagram carousel published under /reel/ shortcode: always returns cover photo, img_index ignored, no picker response

[sgtkuncoro]

Bug report

Instance: self-hosted, ghcr.io/imputnet/cobalt (confirmed on the current latest digest as of 2026-08-23, sha256:63186dd6..., not a stale-build issue).

URL: https://www.instagram.com/reel/DZuTdEoPFUW/

Expected: either a video tunnel/redirect for the video content, or a picker response listing the carousel's items so the caller can choose.

Actual: always returns status: "tunnel" with a JPEG (instagram_DZuTdEoPFUW.jpg), the post's cover image, never a video and never a picker response.

Why this is a carousel-detection bug, not a "photo-only post"

Fetching the post's own public page HTML confirms it's a 10-item carousel with mixed media types (some photos, some videos), published under a /reel/ shortcode:

• Embedded structural fields on the page: "product_type":"carousel_container", "carousel_media_count":10, multiple "media_type":2 entries (Instagram's internal code for video) among the carousel items, plus "video_versions", "video_dash_manifest", and "has_audio":true present on the page — i.e. real video assets exist for at least one item in this carousel.
• Requesting the equivalent /p/<shortcode>/ post URL form instead of /reel/ produces the identical result (same cover JPEG).
• Appending ?img_index=N for N = 1..4 (Instagram's own UI convention for deep-linking a carousel slide) has no effect — the API returns the exact same JPEG filename/content for every index.

So the request body's url and img_index don't appear to influence Instagram-carousel resolution at all when the shortcode is under /reel/ (or /p/) with underlying carousel content that includes video items — the resolver seems to always fall back to the top-level cover image rather than either picking the video item(s) or returning a picker response.

Repro steps

POST /
{
  "url": "https://www.instagram.com/reel/DZuTdEoPFUW/",
  "videoQuality": "360",
  "downloadMode": "auto"
}

Response is consistently:

{
  "status": "tunnel",
  "url": "<tunnel url>",
  "filename": "instagram_DZuTdEoPFUW.jpg"
}

Same result for https://www.instagram.com/p/DZuTdEoPFUW/ and for ?img_index=1 through ?img_index=4 on either URL form.

Impact

Any Instagram carousel post that contains video items but is accessed via a /reel/ shortcode (which Instagram now allows for carousels, not just single-clip reels) silently returns only the cover photo with a "success" status, with no way for the caller to detect the mismatch except by inspecting the downloaded content's type after the fact.

[sgtkuncoro]

Follow-up after digging further: this looks like it goes deeper than a carousel/reel-shortcode resolution bug.

Reproduced getMediaId() (oEmbed) + requestMobileApi() (/api/v1/media/<id>/info/) exactly as instagram.js does it, unauthenticated:

• oEmbed resolves the shortcode to a media_id fine (200, type: "rich").
• The mobile media-info call for that media_id now returns HTTP 403 with {"message":"login_required","error_title":"You've Been Logged Out",...} when unauthenticated (no cookie, no bearer token).

So requestMobileApi() returns undefined here (its response has no .items), which correctly makes hasData() fail and should fall through to requestHTML() / requestGQL(). But the embed HTML path (/p/<id>/embed/captioned/) no longer contains the "init",[],[...]], script blob the current regex expects - that page format seems to have changed since this code was written, so that fallback silently returns nothing too. Haven't fully traced whether requestGQL() (with its LSD/CSRF token extraction) still succeeds, but its inputs (LSD, csrf_token, SiteData fields) are all still present in the page HTML, so it may be the last viable anonymous path.

Net effect for the caller: every fallback in the chain either 403s or silently returns nothing, and getPost()'s only remaining producer of a non-error result ends up being whatever partial/cover-only data survives, hence the cover-photo-only tunnel response instead of a proper error or picker.

This may not be specific to reel-shortcode carousels at all - it looks like Instagram has tightened unauthenticated access to the mobile media-info API more broadly, and the embed-HTML fallback may be stale against a page format change. Flagging in case that's useful context; happy to share the exact request/response shapes if it helps narrow it down.