In this guide · 8 sections
- 01What Meta allows: the official Instagram messaging API
- 02Instagram messaging windows and limits (2026)
- 03How comment-to-DM automation works
- 04Bot disclosure and human handover
- 05What gets accounts restricted
- 06How to choose an Instagram DM automation tool
- 07Do it yourself or get help?
- 08Frequently asked questions
Short answer
Meta allows automated Instagram DMs only through its official API, and only to people who messaged or commented first. You can reply within the 24-hour window, send one private reply per comment within 7 days, and use the Human Agent tag for 7 days. Password-based tools break Instagram's Terms.
What Meta allows: the official Instagram messaging API
Automation is allowed when it runs through Meta's Instagram messaging API, which works with Instagram professional (business or creator) accounts. The key rule from Meta's documentation: your app can only send a message to an Instagram user after that user has sent your account a message, and only within the messaging window.
Tools that use the official API connect through a Meta login screen where you grant permissions. Tools that ask for your Instagram username and password, or run a browser that clicks for you, are a different thing entirely.
Instagram messaging windows and limits (2026)
Meta's messaging policy overview (updated 28 September 2026) covers both Messenger and the Instagram messaging API.
| Situation | What you can send | Time limit |
|---|---|---|
| Customer sends you a DM | Any reply, automated or human | 24 hours from their last message |
| Customer messages after clicking a Click-to-Direct ad | Any reply | Up to 7 days from that message |
| Customer comments on a post, reel, story or ad | One private reply to that comment | Within 7 days of the comment; during the broadcast for Lives |
| Staff need longer to answer | Reply with the Human Agent tag | Separate 7-day window |
| Customer has not contacted you | Nothing | Not allowed |
| Promotional broadcast to past contacts | Not available on Instagram | Sponsored messages and one-time notifications are Messenger-only |
Meta also requires automated bots to respond to any input from the user and within 30 seconds. Group messaging is not supported through the API: one customer per conversation.
How comment-to-DM automation works
"Comment KEYWORD and we'll DM you the link" is the most popular Instagram automation. Under the hood it uses Meta's private replies feature.
Someone comments on your post, reel, story, Live or ad
Meta sends your tool a webhook with the comment ID, the commenter's username and the comment text.
Your tool checks the keyword
If the comment matches (for example "PRICE"), the tool prepares the reply.
One private reply is sent
It lands in the person's inbox if they follow you, or in their message requests if they do not. It includes a link to the post they commented on.
The conversation opens only if they reply
Meta says follow-up messages can only be sent if the person responds, and then within 24 hours of that response.
Two practical points: replies to non-followers land in Requests, where many people never look, so also reply publicly to the comment. And keep the private reply useful (the link, the price, the answer) rather than a sales pitch, because people can report messages as spam.
Bot disclosure and human handover
Meta's policy says that where the law requires it, automated chats must disclose that the person is talking to an automated service, including when a chat switches from a human to automation. Even where it is not required, Meta recommends telling users. Suggested wording includes "I'm the [Page Name] bot" or "You are talking to a bot".
Meta's Instagram messaging documentation also describes how to give automated experiences an escalation path: either a custom inbox in the same app, or the Handover Protocol to pass the conversation to another app where a person replies.
Handover checklist
If you want Instagram, WhatsApp and Messenger in one place for staff, our guide to a unified inbox for WhatsApp, Instagram and Messenger compares the options.
What gets accounts restricted
Restrictions usually come from patterns that look like spam or from unofficial access, not from automation itself.
Generally safe
- Tools connected through Meta's official login and API
- Auto-replies to people who messaged you first
- One private reply per keyword comment, within 7 days
- Clear bot disclosure and a route to a human
- Messages people asked for: links, prices, booking details
Likely to cause trouble
- Tools that ask for your Instagram password
- Cold DMs to people who never contacted you
- Mass follow, like or DM scripts and browser bots
- Sending the same promotional text to everyone repeatedly
- Ignoring replies or never answering "stop"
If an unofficial tool has already had your password, change it, turn on two-factor authentication and remove unknown logins. Our guide to recovering a hacked social media or WhatsApp business account covers the steps.
How to choose an Instagram DM automation tool
Before paying for a tool, check these points on its website or with its support team.
- Official API: does it connect through Meta's login and permissions, and is it a Meta Business Partner or listed app? It should never ask for your password.
- Respects the windows: it should stop free-form messages after 24 hours and only send one private reply per comment.
- Human inbox: can staff take over a conversation and see history?
- Data: where are conversations and contact details stored, and can you export or delete them? Singapore's PDPA applies to customer data you collect in DMs.
- Cost model: per contact, per message or flat fee, and what happens when a reel goes viral.
Do it yourself or get help?
For simple keyword replies, a reputable official-API tool set up by the account owner is usually enough. Connecting Instagram DMs to a booking system, CRM or AI assistant that answers from your own content, with proper handover, is more involved.
IT Sorted is a Singapore-based team of developers with over 10 years of experience. Our AI Website Assistant (S$790) answers customer questions from your FAQ, prices and policies and hands over to WhatsApp or email, with guard-rails so it only talks about your business. For order and appointment messages on WhatsApp, WhatsApp Notifications (S$590) sets up the official API with approved templates. Instagram-specific automations are quoted in writing.
Frequently asked questions
Yes, when it runs through Meta's official Instagram messaging API on a professional account. You can automatically reply to people who messaged you first within the 24-hour window and send one private reply to each comment within 7 days. Tools that log in with your password or message people who never contacted you are not allowed.
Yes, using private replies. Meta allows one private reply per comment, sent within 7 days of the comment, or during the broadcast for Instagram Live. The reply goes to the inbox of followers and to message requests for non-followers. Further messages are only allowed if the person replies, within 24 hours.
The standard messaging window is 24 hours from the customer's last message. It can last up to 7 days when the customer's first message follows a click on a Click-to-Direct ad. If a human agent needs more time, replies tagged with the Human Agent tag have a separate 7-day window.
Meta's policy requires disclosure where the law requires it, including when a chat moves from a human to automation, and recommends it everywhere else. A short line such as "I'm the shop's automated assistant, type human to reach our team" meets that expectation and reduces complaints and spam reports.
Common causes are tools that log in with your password or automate clicks in a browser, sending unsolicited DMs, or sending the same promotional message to many people. Instagram's Terms prohibit automated access without permission. Switch to an official-API tool, change your password, enable two-factor authentication and follow Instagram's appeal steps.