The Instagram auth that broke 10 workflows at once

We had 10 GitHub Actions workflows feeding content to Instagram. One morning, all 10 failed simultaneously with PhotoNotUpload: {"message":"login_required"}. Not gradual — instant, total, silent.

The root cause was an instagrapi session file that expired overnight. Instagram's unofficial API uses a saved session cookie for auth, and when that cookie expires, every single posting job goes dark at once. No partial degradation, no warning — just all-red from one morning to the next.

What made it worse: the AI caption API key (Together AI) had also expired in the same window. So even if the session had survived, the captions wouldn't have generated. Two independent credentials, both silently dead, and the monitoring only checked workflow exit codes (which were non-zero but identical to a transient API timeout).

The fix had three parts: re-authenticate Instagram interactively and store the session as a base64-encoded GitHub secret; rotate the AI key; add a dedicated session-freshness canary job that alerts distinctly from a generic workflow failure.

The structural lesson: unofficial session-based integrations rot silently. The only reliable path is the official Graph API with OAuth tokens. We're migrating, but the migration itself is a project — and every week the session doesn't expire is a week we deprioritise it. That's the trap.