Instagram Messaging API: How DM Automation Works (2026)

The Instagram Messaging API is Meta's official way for software to read and answer Instagram DMs on behalf of a professional account. Every legitimate DM tool, from ManyChat to an AI setter, runs on it. It works like this: someone messages you or comments on your post, Meta pings the connected tool with a webhook, and the tool replies through the API inside a fixed time window. It is free to use, it only works on Business and Creator accounts, and it is reply-only by design. No tool on the official API can send a cold DM to someone who never contacted you.

That one paragraph answers most of what people search. The rest of this page is the part that decides whether your Instagram DM automation actually works: the two ways to connect, the timing rules that quietly break flows, the real rate limits (and the "200 DMs an hour" myth), what the API costs, what it cannot do, and how coaches use it to turn comments into booked sales calls.

What Is the Instagram Messaging API?

The Instagram Messaging API is the messaging part of Meta's Instagram Platform. It lets an approved app receive Instagram Direct messages in real time, send replies, answer comments privately, and manage conversations for a professional account. It was originally branded the Messenger API for Instagram, because it was built on the same Messenger Platform that powers Facebook Page inboxes, which is why you still see both names in Meta's documentation and on developer forums.

Three facts define it in 2026:

• Professional accounts only. The account must be an Instagram Creator or Business account. Personal accounts have no API access at all since Meta shut down the old Instagram Basic Display API on December 4, 2024.
• Reply-only. The business can only message people who acted first: they sent a DM, replied to a story, tapped an ad, or commented on a post. There is no endpoint for cold outreach, at any price or partner level.
• Event-driven. Your app does not poll the inbox. Meta pushes each new message, comment, button tap, or story mention to your server as a webhook, and your app answers with a call to the send endpoint.

If you have read our explainer on the WhatsApp API, the shape will feel familiar. The big difference is money and access: WhatsApp bills per message and requires a phone number on the Business Platform, while Instagram's messaging API charges nothing and plugs into the account you already have.

Instagram Login vs Facebook Login: The Two Ways In

There are two official routes to the Instagram Messaging API, and the one you choose changes your setup, your token, and which Meta pages apply to you.

Business Login for Instagram arrived in July 2024 and removed the most annoying step in the old setup: creating a Facebook Page just to connect a DM tool. If an older guide (including some tool onboarding screens) tells you a Page is mandatory, it is describing the Facebook Login path only.

One practical gotcha for anyone building on the Instagram Login path: in our own integration, the legacy api.instagram.com/oauth/authorize URL stopped serving the login screen in August 2026. Meta's documented authorize URL is www.instagram.com/oauth/authorize with the same parameters, while the token exchange still runs on api.instagram.com/oauth/access_token. If users suddenly see "Sorry, this page isn't available" when connecting, check that URL first.

How Instagram DM Automation Works, Step by Step

Every Instagram DM automation, whether it is a keyword flow or an AI conversation, runs the same five-step loop on the API.

1. The lead acts. They send a DM, reply to your story, mention you in their story, tap a button, click a Click-to-Direct ad, or comment a keyword under a reel.
2. Meta sends a webhook. Within seconds, Meta posts an event to the URL your app subscribed. It includes the sender's Instagram-scoped ID (a per-app ID, not their username), the message text or attachment, and a timestamp. For comments, it includes the comment ID and the media it was posted on.
3. Your app decides. A flow builder matches a keyword and picks a canned message. An AI setter reads the message, the conversation history, and your offer, then writes a reply.
4. Your app calls the send endpoint. It posts the reply to the account's /messages endpoint, addressed either to the person's ID (a normal DM) or to the comment ID (a private reply).
5. The message lands. It shows up in the lead's inbox, or in their message requests folder if they do not follow you yet.

Here is what step 4 looks like in practice. A normal reply to someone who messaged you:

POST https://graph.instagram.com/v23.0/{ig-user-id}/messages
{
  "recipient": { "id": "{instagram-scoped-id}" },
  "message": { "text": "Thanks for reaching out! What is your main goal right now?" }
}

And a private reply to a comment, which is how comment-to-DM automation works under the hood:

POST https://graph.instagram.com/v23.0/{ig-user-id}/messages
{
  "recipient": { "comment_id": "{comment-id}" },
  "message": { "text": "Here is the free guide you asked for. Quick question: are you coaching full time yet?" }
}

Which events can trigger an automation

The webhook events matter because each one is a different entry point you can automate:

• Messages: any new DM, including the first message from a stranger that lands in Requests.
• Comments: comments on posts, reels, and ads, including ads that never appear on your feed.
• Story replies: a reply to your story arrives as a message with a reference to the story.
• Story mentions: when someone tags you in their story, you receive it as a message with a story mention attachment.
• Postbacks and quick replies: taps on buttons and quick-reply chips you sent.
• Referrals: the person arrived from an ad or an ig.me link carrying a reference parameter.
• Reactions and read receipts: useful for analytics, rarely for triggers.

One testing tip that saves hours: comments and DMs from the account that owns the post never start an automation. Test from a second Instagram account, or you will think your setup is broken when it is not.

The Timing Rules That Decide Every Flow

The Instagram Messaging API runs on clocks, not on permission alone. Most "my automation stopped working" tickets come down to one of these windows.

The 24-hour standard messaging window

After a person messages your account, your app has 24 hours to reply. Every new message from them resets the clock. Once 24 hours pass with no message from the lead, any automated send fails, and only the lead writing again reopens the window. This is the rule that makes the API spam-resistant, and it is why a good tool schedules follow-ups inside the window instead of waiting a polite three days.

Private replies: one message per comment, within 7 days

When someone comments on your post or reel, your app can send exactly one private reply to that comment, and it must go out within 7 days of the comment. For Instagram Live, private replies only work while the broadcast is running. After that single message, you can only continue if the person responds, and then the normal 24-hour window applies from their reply. That is why the first DM in a comment-to-DM flow must ask a question, not just drop a link: a link with no question gets read and the conversation ends there.

The human agent tag: 7 days, humans only

Meta offers a HUMAN_AGENT message tag that lets a person reply up to 7 days after the lead's last message. It requires its own App Review approval, and Meta scopes it to a real human answering an inquiry that could not be resolved in the standard window. It is not a loophole for automated follow-ups, and a tool that uses it that way is putting your account at risk.

Click-to-Direct ads: up to 7 days

On September 28, 2026, Meta updated its Instagram messaging changelog: the standard window may extend up to 7 days for conversations that start from Click-to-Messenger or Click-to-Direct ads, counted from the person's first message after clicking the ad. Conversations from every other entry point, including organic comments and story replies, keep the 24-hour window.

Instagram Messaging API Rate Limits (and the 200 DMs Myth)

Meta publishes per-second and per-hour call ceilings for Instagram messaging, and for most coaches and creators they never bind. Here is what Meta's documentation lists per Instagram professional account:

• Send API, Instagram Login path: 100 calls per second for text, links, reactions, and stickers, and 10 per second for audio or video.
• Send API, Facebook Login path: Meta's Messenger rate-limit page lists 300 calls per second for text and 10 per second for audio or video.
• Private replies to post and reel comments: 750 calls per hour. This is the one a viral "comment GUIDE" reel can actually hit.
• Private replies on Live comments: 100 calls per second, only while the broadcast runs.
• Conversations API (reading threads): 2 calls per second.
• Message size: text is capped at 1,000 bytes, so emoji and accented characters eat into it faster than plain letters.
• High-volume inboxes: an account that sends and receives more than 72,000 messages stops showing new messages and cannot send until the volume drops. Meta does not state over what period that is counted.

And the myth: you will read everywhere that Instagram allows "200 automated DMs per hour." Meta's rate-limit pages do not set that number for Instagram messaging. It is a pacing figure several automation vendors chose for themselves to stay clear of anti-spam systems. If a tool quotes it, ask whether it is their throttle or Meta's ceiling.

The limits that actually stop real accounts are behavioral. Meta's developer policies say messaging experiences that receive excessive negative feedback can be limited, paused, or removed, and sending too many messages into a single thread can be rate limited. Our breakdown of whether ManyChat is safe covers the behaviors that get accounts flagged even on the official API.

Is the Instagram Messaging API Free?

Yes. Meta does not charge per message, per conversation, or per API call for Instagram messaging. That is a real difference from WhatsApp, where Meta bills per delivered message and, since October 1, 2026, also charges for service replies after the first 1,000 per phone number each month.

Free does not mean zero cost, though. The real costs of running Instagram DMs on the API are:

• Building it yourself: developer time, a server to receive webhooks, token refresh logic, monitoring, and a database for conversation state.
• App Review and Business Verification: free in money, expensive in time if your app serves accounts you do not own (more on that below).
• Using a tool instead: a monthly subscription to a Meta partner that already holds the permissions. That is what most coaches pay for, and it is where pricing differences between tools come from, not from Meta.

Build It Yourself or Use a Meta Partner Tool?

The deciding question is whose accounts your app will serve.

Your own account, or one you manage: Standard Access is enough. You can build, test, and run an app against your own professional account without going through App Review. This is the path for a developer who wants a custom inbox or an internal bot.

Other people's accounts: If your app serves Instagram professional accounts you do not own or manage, Meta requires Advanced Access, which means App Review for each permission plus Business Verification of your company. You record a screencast of your use case, justify every permission separately, and wait for approval. Agencies building a product for clients land here.

For a coach, a creator, or an SMMA running client accounts, building from scratch rarely makes sense. A Meta partner tool has already passed review, already handles token refresh and webhooks, and already deals with the edge cases. The choice is really about which kind of tool:

If you are comparing tools, our tests of Instagram DM bots and the Instagram auto DM guide go deeper on which ones connect safely and what each trigger type costs you.

What the Instagram Messaging API Can and Cannot Do

Knowing the edges of the API saves you from buying a tool that promises something Meta does not allow.

What it can do

• Reply to DMs and story replies with text, images, video, audio, and stickers, inside the window.
• Send one private reply per comment, on organic posts, reels, and ads.
• React to messages and show typing indicators.
• Send quick-reply chips (up to 13 per message) and up to 3 buttons, though not both in the same message. Developers report that these interactive elements render in the mobile app but not on desktop Instagram, so keep a plain-text fallback.
• Show ice breakers, the up-to-4 starter questions a new visitor sees before their first message, and a persistent menu.
• Read conversations so a tool can show history and give an AI context.
• Hand a conversation over between apps or to a human, so your AI and your team can share one inbox.

What it cannot do

• Start a conversation. No cold DMs, no follow-to-DM blasts to people who never messaged you.
• Message after the window closes with automation. A closed window stays closed until the lead writes again.
• Send more than one message to a commenter unless they reply.
• Mark messages as read in your Instagram app. A message counts as read only once a reply is sent, which is why your phone may show unread badges for threads your tool already handled.
• Reach stale requests. Message requests with no activity for 30 days stop being returned by the API.
• Work on personal accounts. Switch to Creator or Business first.

Native Instagram tools like Saved replies still work alongside a connected tool, but they are manual shortcuts, not API automation. The API is what lets software answer while you sleep.

How Coaches Use the API to Book More Sales Calls

For a coach selling a high-ticket program, the API is not the strategy. It is the plumbing that lets a sales process run inside Instagram DMs without you living in the inbox. A typical setup looks like this:

1. A reel ends with a call to comment a keyword, for example "comment PLAN for my free meal-prep template."
2. The private reply delivers the value and asks one question, so the lead answers and opens a 24-hour window.
3. The conversation qualifies the lead: goal, timeline, what they have tried, and whether they are ready to invest in coaching.
4. Qualified leads get a booking link or a slot inside the chat. The sale itself happens later, on the call, with you or your closer.
5. Unqualified leads get a helpful resource instead of a calendar slot, so your calendar only holds real prospects.

Timing is where most setups leak. Because automation dies when the 24-hour window closes, a follow-up scheduled for "tomorrow afternoon" often never sends. And follow-ups matter: in our analysis of 828K DM conversations, a single follow-up doubles booked calls among engaged leads. The fix is to schedule follow-ups inside the window, not after it.

This is the job an AI setter does on top of the API. SetSmart is an Official Meta Business Partner that connects through Business Login for Instagram, so no Facebook Page is needed. It triggers on keyword comments under posts, reels, and ads (including dark posts that never show on your feed), story replies, and story mentions, then holds a real conversation that asks your qualifying questions. It sends a first follow-up after 4 hours and a second one around the 22-hour mark, both inside Meta's window, and books qualified leads straight into your calendar. Speed helps too: leads answered in seconds instead of hours are far more likely to keep talking, a pattern we unpack in our lead response time statistics.

Mathis Ladoué, an online fitness coach with 22.4K followers, put it simply: "I book 15 to 25 calls per week... without managing a single setter."

Common Instagram Messaging API Errors and What They Mean

When an automation fails, the API usually tells you why. These are the errors coaches and agencies hit most:

• "Outside of allowed window" (error code 10, subcode 2534022). The lead has not written in the last 24 hours. Do not retry: nothing reopens the window except the lead messaging again.
• Private reply rejected on an old comment. The comment is more than 7 days old, or a private reply was already sent for it.
• Permission errors after connecting. The app was authorized without the messaging or comments permission. Reconnect and accept every requested permission.
• No messages arriving on the Facebook Login path. On Instagram, check that message access for connected tools is allowed in your message settings, and that the Instagram account is still linked to the right Facebook Page.
• Login screen says the page is unavailable. On the Instagram Login path, the app is using the retired api.instagram.com/oauth/authorize URL instead of www.instagram.com/oauth/authorize.
• Automation never fires during testing. You commented from the account that owns the post. Use a second account.

If you want to go one step further and let an AI assistant like Claude read and act on your inbox, an Instagram MCP server sits on top of the same official API.

FAQ

Is the Instagram Messaging API free?

Yes. Meta charges nothing per message or per API call for Instagram messaging. Your costs are development time and hosting if you build it yourself, or a monthly subscription if you use a Meta partner tool. WhatsApp is different: Meta bills per delivered message there.

Can you automate DMs on Instagram?

Yes, through the official Instagram Messaging API. A tool can automatically answer anyone who sends you a DM, replies to your story, mentions you, clicks your ad, or comments a keyword on your post. It cannot message people who never contacted you, and automated replies must go out within the messaging window.

Does Instagram allow API access for personal accounts?

No. Since Meta retired the Basic Display API on December 4, 2024, only professional accounts (Creator or Business) can use the Instagram API. Switching is free and takes a minute in Settings and privacy, Account type and tools.

What are the limitations of the Instagram Messaging API?

It is reply-only, automated replies must be sent within 24 hours of the lead's last message, each comment gets one private reply within 7 days, and private replies are capped at 750 per hour per account. Message text is limited to 1,000 bytes, and requests inactive for 30 days drop out of API reach.

Do I need a Facebook Page to use the Instagram DM API?

Not anymore. The Instagram API with Instagram Login, available since July 2024, connects a professional account directly with no Facebook Page. The older Facebook Login path still requires a Page linked to the Instagram account.

How long do you have to reply to an Instagram DM through the API?

For automated replies, 24 hours from the lead's most recent message, and the clock resets each time they write. Conversations started from Click-to-Direct ads can stay open up to 7 days, and a human agent with the approved HUMAN_AGENT tag can reply up to 7 days after the last message.