IAM cookies import format — exactly which fields, exactly which order

The 4 fields that decide everything

IAM v3.0.8.4 reads cookies through a strict schema. If any of these is missing or expired, the session won't restore and the account is unusable until you re-fetch:

• sessionid — the auth token. Without this, dead.
• ds_user_id — IG's numeric user id, cross-checked against sessionid.
• csrftoken — required on every write.
• mid — install fingerprint, missing it triggers UFAC selfie a lot earlier.

Optional but adds trust: ig_did, rur, shbid, shbts.

The format IAM wants

[
  {"domain":".instagram.com","name":"sessionid","value":"…","path":"/","expirationDate":1812345678},
  {"domain":".instagram.com","name":"ds_user_id","value":"…","path":"/","expirationDate":1812345678},
  {"domain":".instagram.com","name":"csrftoken","value":"…","path":"/","expirationDate":1812345678},
  {"domain":".instagram.com","name":"mid","value":"…","path":"/","expirationDate":1812345678}
]

Domain MUST start with a dot. Path MUST be "/". expirationDate is Unix epoch seconds (NOT milliseconds — 30 % of bad imports we see are JS Date.now() values divided by 1000 wrong).

Common mistakes that lose accounts

• Mixed-domain blobs. Some scrapers ship cookies for instagram.com AND facebook.com in one file. IAM imports both, IG sees the FB cookies, marks the install as cross-app, lowers trust.
• Stale csrftoken. If your scraper grabbed cookies hours after login, the csrftoken may have rotated. Re-fetch fresh.
• JSON-string-of-JSON. Some Telegram bots ship the whole array as a string with escaped quotes. IAM wants the actual array.
• UTF-8 BOM. Cookies pasted from Notepad++ on Windows sometimes get a BOM byte at the start that breaks parsing silently.

Free auto-fixer

Paste any cookie blob into our Cookie Validator. It detects format (JSON array / JSON object / Netscape cookies.txt / raw header), checks the 4 required fields with expiration status, and re-emits the IAM-ready array. Runs entirely in your browser — we never see the cookies.