Android vs iOS session/header consistency and sensitive route bootstrap order

[andas1n]

Hi, I have a question about Android vs iOS session contexts in instagrapi.

From what I understand, instagrapi is mainly Android private API shaped. I’m trying to understand whether it is valid to mix Android-authenticated sessions with iOS-
style headers, or whether Android and iOS sessions should be treated as completely separate session types.

Context:

• Accounts were originally created/used on iOS.
• Logging through instagrapi username/password creates a normal Android-shaped saved session.
• Basic routes work with the normal instagrapi session:
  • current user
  • own profile
  • own medias
  • media info
  • own stories
  • own highlights
• When testing more sensitive routes, some return login_required, especially:
  • media insights
  • story link validation
  • sometimes stories/highlights after a sensitive route fails

Questions:

1. Should an instagrapi login session always remain Android-shaped?

2. Is it invalid/risky to override an Android instagrapi session with iOS headers such as:

   • iOS User-Agent
   • iOS X-IG-App-ID
   • X-IG-Device-ID
   • X-IG-Family-Device-ID
   • X-Bloks-Version-ID
   • X-IG-Capabilities
   • IG-U-DS-USER-ID / IG-INTENDED-USER-ID

3. If current_user works but stories/highlights/insights return login_required, does that usually point to:

   • mixed/wrong app session context
   • missing/stale IG-U-RUR or X-IG-WWW-Claim
   • missing bootstrap/sync route before the sensitive route
   • account-level restriction
   • or unsupported/incomplete payload?

4. Are routes like stories, highlights, story link validation, media insights, or Reels upload known to be sensitive to route order?

5. Is there a recommended bootstrap sequence before calling sensitive private routes? For example:

   • account/current_user
   • launcher/sync
   • qe/sync
   • feed/timeline
   • any other state-refresh route

6. Does instagrapi support importing an existing iOS mobile bearer session cleanly, or would that require a separate session implementation from the Android login/
   session model?

I can provide redacted route order, cl.last_json, app version, and header presence if useful. No raw tokens, cookies, passwords, or proxy credentials.

[subzeroid]

Answered for current instagrapi behavior: instagrapi is an Android private API client, so keep Android device/session/header state internally consistent. Do not mix iOS headers or rotate device identity after login. Sensitive routes can still depend on Instagram account trust and may require an app-like warmup on the same stable session.