Instagram bots in 2026: what they do, what gets you banned, and the API way
Most tools sold as an Instagram bot do one of three different jobs, and only two of them are allowed. Driving your account from the outside breaks Meta's developer policies. Replying to comments and DMs through the official API does not. Here is the difference, with the published rate limits, checked October 14, 2026.
The word is doing too much work. When someone searches for an Instagram bot they might want followers, or they might want their DMs answered at 2am. Those are opposite products with opposite risk profiles, and the search results mix them freely.
The three families behind the word instagram bots
| Family | What it does | How it connects | Price | Account risk |
|---|---|---|---|---|
| Account-driving bots | follow and unfollow, mass likes, auto-comments on strangers' posts, cold DMs at volume | logs in as you, or drives a session Meta did not authorize | not priced here, see below | high: hits several policy clauses at once |
| Official-API automation | replies to comments on your posts, comment-to-DM, answers in the 24 hour DM window, scheduled publishing | Instagram Graph API with a reviewed app and your consent | Metricool from $20/mo annual, $25/mo monthly; PlugKit $49/mo | low: this is the documented use |
| Agents | decides what to write, then uses the same official API to publish and reply | an MCP server or REST calls on top of the official API | PlugKit $49/mo for 5 accounts, $97/mo for 30, plus your model cost | low, with one caveat: it writes on its own |
On the first row, a deliberate choice: I am not publishing prices for tools whose core function breaches the Platform Terms, and I am not linking to them. Every figure in the other rows was taken from the vendor's own pricing page on October 14, 2026, and the Metricool numbers are broken down in Metricool pricing.
What actually gets you banned
Meta's developer policies are specific, and the account-driving family collides with them in more than one place:
- §2.7 bars participating in any program that promotes or facilitates the purchase, sale or exchange of Likes, Shares or Followers. That is the growth-bot business model stated as a prohibition.
- §1.7 requires you to obtain consent from people before publishing content or taking any other action on their behalf. A tool that comments as you on accounts you never saw does not have it.
- §6.2, in the Instagram Platform section, bars using the platform to manage Instagram relationships without Meta's prior permission. Mass follow and unfollow is relationship management.
- §5.6.2.b, on messaging, classes creating bots at very high frequencies as spam, and separately prohibits facilitating or encouraging inauthentic behavior.
- §2.2 asks you to respect the limits placed on product functionality, which is the clause that turns "I just raised the delay between actions" into a policy question rather than a technical one.
What enforcement looks like in practice is not a ban notice. It is the "we suspect automated behavior" interstitial, action blocks that last hours or days, reach that quietly drops, and in the worst case a disabled account with an appeal form. The pattern I have seen most is the slow version: nothing is announced, posts just stop travelling. Our longer piece on what Meta allows and what gets you flagged covers the enforcement side in detail.
One nuance worth stating plainly: the risk is not proportional to how careful the tool is. Randomized delays and residential proxies reduce detection, not the breach. The clause is about what you are doing, not how smoothly you do it.
Is there a free instagram bot?
Three honest answers, depending on what you meant.
For posting and basic analytics, yes. Metricool runs a level at $0 a month covering 1 brand, 20 scheduled posts a month, 5 competitor profiles and 30 days of analytics history, with every network except LinkedIn and X. For one small account that is a real tool at no cost, and it is the most honest answer to this query.
For comment and DM automation, mostly no. The products that do it well charge, because they carry reviewed Meta apps, token refresh and webhook infrastructure. Where a "free" option exists it is usually a trial or a contact-capped entry level. If your meter is contacts rather than brands, ManyChat pricing explains that model.
For follower growth, the free tools are the dangerous ones. A service that costs nothing and promises followers is monetising something else: your session, your data, or a trial that ends in an upsell. The ones I would not install are precisely the ones with no payment page.
What the best instagram bot can actually do
Set the growth tools aside and the question becomes concrete: what does the official API permit? According to Meta's Instagram Platform documentation, three APIs exist now:
- Instagram API with Instagram Login, for Business and Creator accounts. Publishes media, reads and replies to comments on your own media, sends and receives messages with Instagram users, and spots media where you were mentioned.
- Instagram API with Facebook Login for Business, for Business and Creator accounts linked to a Facebook Page. Same core, plus hashtagged media search and basic metadata and metrics for other businesses and creators.
- Instagram Messaging via the Messenger API, for Business or Creator accounts linked to a Page, which handles Instagram and Facebook messages in one place.
Note what is missing from all three. There is no endpoint to follow an account, none to like someone else's post, and none to comment on media you do not own. Those capabilities do not exist in the official API, which is exactly why the tools that offer them have to work around it.
A personal account gets none of this. Business or Creator is the entry requirement on every path.
The rate limits nobody reads until they break something
Meta publishes these, and they shape what an automation can realistically do:
| Surface | Published limit |
|---|---|
| Instagram Platform calls | 4800 multiplied by your impressions in the last 24 hours, per app and user, rolling window |
| Conversations API | 2 calls per second per professional account |
| Send API, text and links | 100 calls per second per account |
| Send API, audio or video | 10 calls per second per account |
| Private replies to comments on posts and reels | 750 calls per hour per account |
| Private replies to Live comments | 100 calls per second per account |
The first row is the trap. Your call budget scales with your impressions, so a small account has a small budget. Messaging is excluded from that formula and gets its own per-second limits. Business Discovery and Hashtag Search fall under separate platform limits again.
The 750 per hour figure on private replies is the real ceiling for comment-to-DM. A Reel that takes off and draws 5,000 keyword comments in an hour cannot be answered in that hour, whatever tool you use. Anyone promising otherwise is describing something the API does not do. The mechanics are in comment-to-DM automation on Instagram.
The API way, and where an agent fits
The pattern that works: use the official API for the actions, and put the judgement somewhere that can be reviewed. PlugKit connects Instagram, Facebook, LinkedIn, TikTok, YouTube, X, WhatsApp and Telegram behind one API and a hosted MCP server, so an agent gets publishing, comments, the inbox, analytics and comment-to-DM automations without you building an OAuth flow per platform. It is $49 a month for 5 connected accounts, cancel anytime, $97 for 30. There are 7 days free, no card, with 1 connected account during the trial.
The caveat I would want told to me: an agent with write access publishes and replies immediately, in public. PlugKit's MCP server has two OAuth scopes, mcp:read and mcp:write. Start on mcp:read for a week and watch what it would have said. For the setup, see the Instagram MCP server page.
FAQ
Are Instagram bots illegal?
Not illegal in the criminal sense, but tools that follow, like or comment on your behalf at volume breach Meta's developer policies, including §2.7 on trading Likes and Followers and §1.7 on acting without consent. The consequence is enforcement on your account, not a court: action blocks, reduced reach, or a disabled account.
Can I use a bot to reply to Instagram DMs?
Yes, through the official API, and this is the documented use. You can send and receive messages with people who have messaged you, inside the 24 hour window Meta allows for a reply. The Send API permits 100 calls per second per account for text, and private replies to comments on posts and reels are capped at 750 per hour.
Will Instagram ban me for scheduling posts?
No. Publishing through the Graph API with a Business or Creator account is the supported path, and it is what every mainstream scheduler uses. Bans come from driving the account in ways Meta did not authorize, not from scheduling. See how to automate Instagram posts for the mechanics.
Can a bot follow or like for me through the API?
No. The official Instagram APIs have no endpoint to follow an account, like someone else's post, or comment on media you do not own. Any tool offering those is working outside the API, usually by driving a logged-in session, which is where the policy problem starts.
What is the difference between an Instagram bot and an AI agent?
A bot runs a fixed rule: keyword in, canned message out. An agent decides what to write, which account to answer first, and when to leave something alone, then calls the same official API to act. The API surface is identical. What changes is where the judgement lives, and that an agent can be wrong in novel ways, which is why read-only access first is worth the week.
One plug for every platform your agent touches
$49 a month for 5 connected accounts, cancel anytime. Every feature in every plan.
Get your API key →