Meta allows automated Instagram DMs only through its official Messaging API, used by a professional (creator or business) account, and only in reply to people who contacted you first. An approved tool can answer messages inside the standard messaging window that opens when someone writes to you, send one private reply to a person who commented on your post, and hand the chat to a human who can keep replying for longer under the human agent tag. Cold DMs to people who never contacted you, bots that log in with your password and promotional follow-ups sent outside the window are not allowed.
This guide covers the rules rather than comparing tools. Chat automation on OnlyFans is covered in our guide to chatting services versus automation tools, and X sets its own limits, explained in our guide to what X's DM rules allow.
The official route: Instagram's Messaging API
Meta's Instagram Platform overview describes two ways an app can handle your messages. The Instagram API with Instagram Login lets an app manage Instagram business or creator accounts, including messaging, without a Facebook Page. Messenger API support for Instagram, which Meta's Developer Policies call the Instagram Messaging API, lets professional accounts manage Instagram and Facebook Page messages in one place, and requires the Instagram account to be linked to a Facebook Page. Neither route covers personal accounts.
The other person has to start. Meta's guide to sending messages says an app can only message an Instagram user after that person has messaged your professional account, and that it then has 24 hours to respond. The same guide says apps serving professional accounts their developer doesn't own or manage need Advanced Access, and it lists group messaging as unsupported.
There is a switch on your side too. Instagram's help page on managing access to messages across apps says that turning on Allow access to messages, found under Messages and story replies, then Message requests, then Connected tools, lets anyone with approved access to your connected Facebook Pages, Meta Business Suite, Business Manager or third-party apps view and send messages from your account. Turn it off and only the Instagram app can read your DMs.
Comment-to-DM: how private replies work
The “comment a keyword and I'll send you the link” pattern runs on a feature Meta calls private replies. Its developer guide to private replies says that when someone comments on your post, reel, story, Live or ad post, an app can send that person one private message within 7 days of the comment, or only while the broadcast is running for Live. The reply goes to their inbox if they follow you and to their message requests if they don't, and it includes a link to the post they commented on.
Follow-ups are tightly limited. The same private replies guide says further messages can only be sent if the person responds, and must go out within 24 hours of that response. A keyword flow can deliver the promised link once; everything after that depends on the commenter writing back.
The messaging window and the human agent tag
Meta's messaging policy for Messenger and Instagram sets the standard window: businesses have up to 24 hours to respond to a user, and messages inside that window may contain promotional content. People can block or mute a conversation with a business at any time.
Outside the window, message tags apply, and the one creators are likely to meet is the human agent tag. Meta's Human Agent feature page says it lets a human agent respond to user messages within 7 days of the user's message, for issues that can't be resolved in the standard window, such as when the business is closed for the weekend, and that apps need app review and business verification to use it.
Several Messenger tools don't exist on Instagram: the messaging policy says one-time notifications, sponsored messages and news messaging aren't available for the Instagram Messaging API. Meta's Developer Policies add that the window opened when someone clicks a Click-to-Instagram-Direct ad and then messages you may last up to 7 days, and that message tags must never carry promotional content, upsells, product announcements, deals, coupons, sale announcements or polls.
Allowed vs not-allowed automation
Each row pairs a trigger with the message it permits, the time limit, the consent it rests on and the Meta page that sets the rule.
| Trigger | Message type | Timing window | Consent basis | Allowed? | Source |
|---|---|---|---|---|---|
| Someone sends you a DM | Automated answer, menu or FAQ reply | Within 24 hours of their message | They opened the conversation | Yes | Send messages |
| Someone comments on your post or reel | A single private reply, often carrying a link | Within 7 days of the comment; during the broadcast for Live | Their public comment | Yes, one message | Private replies |
| The commenter answers your private reply | Follow-up messages in that thread | Within 24 hours of their answer | Their reply to you | Yes | Private replies |
| A fan or client is waiting on a real person | A human-written reply sent with the human agent tag | Within 7 days of their message | Their earlier message | Yes, for support rather than promotion | Human Agent |
| Someone who has never contacted you | Cold outreach pushed through a tool | No window has been opened | None at all | No | Send messages |
| A conversation that went quiet weeks ago | A sale, discount or new-release announcement | Outside the window, sent under a tag | Nothing that covers promotion | No | Developer Policies |
| A person asks you to stop messaging | Any further automated message | From the moment they ask | Withdrawn by the person | No; respect it immediately | Developer Policies |
| A bot logged in with your password | Automated follows, likes, comments or DMs | Whenever the bot runs | No permission from Instagram | No | Terms of Use |
| Someone opens a chat with your account in the app | Instagram's built-in frequently asked questions with automated answers | When they start the chat | They picked the question | Yes, built into Instagram | FAQs on Chats |
The last row is worth trying before any outside tool. Instagram's page on frequently asked questions in Instagram chats says business and creator accounts can show up to four questions, each with an optional automated response, to people who start a chat, which covers the most repetitive DMs without connecting anything.
Opt-in, opt-out, disclosure and spam
The Developer Policies put the responsibility on you and your tool. You must not contact people through Instagram messaging unless you have legally sufficient consent or opt-in under the laws that apply, you must offer a legally sufficient way to opt out on an ongoing basis, and you must immediately respect any request to block, stop or opt out, whether it arrives in the chat or somewhere else.
Disclosure is required in some places. Meta's messaging policy says that where the law requires it, automated chats must tell people they are dealing with an automated service at the start of a conversation, after a significant lapse of time and when a chat moves from a person to automation. It names California and Germany as markets to watch, and recommends disclosing everywhere as good practice.
Spam rules cover automated messages as much as posts. The Developer Policies ban sending spam as the Community Standards define it, including activity at very high frequencies, and warn that messaging experiences drawing excessive negative feedback may be feature limited, paused, rate-limited or removed. Meta's spam policy applies the same thinking across the platform. If your account is already limited, our guide to Instagram account restrictions and action blocks sets out the next steps.
Checklist for vetting any tool you connect
- It connects through Meta's official login and never asks for your Instagram password; Instagram's third-party apps page warns that a password or access token can give an app complete access to your account.
- It shows which permissions it requests, such as profile basics and message management, and explains why it needs each one.
- It only starts a conversation from a message, a comment or an ad click, and refuses to send cold DMs.
- It enforces the timing rules for you: one private reply per comment, follow-ups only after a response and nothing promotional outside the window.
- It can hand a conversation to a person, and uses the human agent tag only for replies a person actually writes.
- It offers a stop keyword or button, and honours blocks and opt-outs straight away.
- It can identify itself as automated wherever the law requires that.
- You know exactly who on your team will be able to read and send DMs once Allow access to messages is on.
- It explains what message data it stores, where, for how long, and how you delete it.
- You know how to disconnect it: Instagram's apps and websites page lists connected tools under Website permissions and says tools holding business or creator permissions aren't expired after 90 days of inactivity, so remove them yourself.
Where this fits with other channels
For one-to-many updates, an Instagram broadcast channel does what tagged DMs may not: it sends announcements to people who chose to join. Our guide to setting up an Instagram broadcast channel covers it. The DM rules above then stay focused on conversations people start with you, which is where automation can save time without breaking anything.
Limitations of this guide
Meta's developer documentation changes often, and features, permissions and review requirements differ between the Instagram Login and Facebook Login routes. This guide reflects Meta's Instagram Platform docs, messaging policy, Developer Policies and help pages as they read on 1 October 2026.
It explains Meta's rules, not the consent, privacy and spam laws of your country, which can be stricter; for those, check your local regulator's guidance or get legal advice. It also can't vouch for any particular tool, since a tool's behaviour can change after you connect it.