Instagram comment bots: auto-reply, moderation and what the API permits
An Instagram comment bot does one of two jobs. It either moderates and answers comments on your own posts, which the official API allows, or it posts comments on other people's posts, which it can only do by logging in as you. The first is supported and rate-limited. The second puts your account at stake. Checked October 20, 2026.
What an Instagram comment bot actually does
Strip the marketing and there are four distinct behaviours sold under one word.
- Auto-reply. Someone comments on your Reel, a rule or a model writes a public reply. Supported by the API.
- Moderation. Hide, unhide or delete comments matching a word list, or turn comments off on a post. Supported by the API.
- Comment-to-DM. A keyword in a comment triggers a private message. Supported, through a separate mechanism with its own time limit.
- Outbound commenting. Your account leaves comments on hashtags, competitors or follower feeds, usually to get noticed. Not supported, and the reason most of this category exists.
The first three run on your own media and need nothing but an app review. The fourth needs control of your account. That split is the whole article, and it decides which tools are safe to buy.
Instagram comment automation: what the official API permits
Meta's comment moderation guide lists the endpoints, and they all act on media "owned by your app users".
| Action | Endpoint | Note |
|---|---|---|
| Read comments on a post | GET /<IG_MEDIA_ID>/comments |
Returns comment ID, text and timestamp |
| Read replies to a comment | GET /<IG_COMMENT_ID>/replies |
One level of threading |
| Reply publicly | POST /<IG_COMMENT_ID>/replies |
The reply is signed by the account |
| Hide or unhide | POST /<IG_COMMENT_ID> |
Reversible, and the author is not notified |
| Delete | DELETE /<IG_COMMENT_ID> |
Irreversible |
| Disable or enable comments | POST /<IG_MEDIA_ID> |
Applies to the whole post |
Permissions depend on which login you use. With Business Login for Instagram it is instagram_business_basic and instagram_business_manage_comments. With Facebook Login for Business it is instagram_basic, instagram_manage_comments and pages_read_engagement. Serving accounts you do not own or manage needs Advanced Access, which means an app review; your own accounts can run on Standard Access once added in the App Dashboard.
Two things worth knowing before you build a rule engine on top. Hiding is quiet, so it is the right default for borderline comments: the author keeps seeing their comment and nobody else does. And a hidden flag can come back empty: PlugKit's engagement guide warns that a null value means the platform does not report it for that object, and says plainly "Do not read null as visible."
The same guide is also where the honest coverage limit sits. Comments work on Instagram, Facebook Page and Threads. Threads refuses delete entirely, because the platform only lets you delete your own posts, so hiding is the fallback there.
Auto comment on Instagram: why no API does it
This is the search most people arrive on, and the answer is short. The official API only exposes comments on media your app user owns. There is no endpoint that posts a comment on a stranger's Reel. A tool that offers it is logging into Instagram as you, in a browser session or a headless one.
That matters for one specific reason: those tools ask for your Instagram password. Meta's Platform Terms say at section 6.a.iii that you must not separately request or collect a Meta user's login credentials for any Meta Products. A product built that way is outside the terms before it posts anything, and the enforcement lands on your account rather than on the vendor.
The pattern that gets flagged is also well known: dozens or hundreds of identical comments an hour, from an account with no matching browsing behaviour. I went through a restriction on July 10 and wrote the whole thing up in Instagram automation rules. For the wider bot landscape, including follow and unfollow, there is Instagram bots in 2026.
The rate limits that decide how fast you can automate Instagram comments
Numbers from the Instagram Platform overview, read today.
| Limit | Value | Scope |
|---|---|---|
| Business Use Case calls | 4800 × impressions in 24 hours | Per app and app user pair |
| Private Replies, post and reel comments | 750 calls per hour | Per professional account |
| Private Replies, live comments | 100 calls per second | Per professional account |
| Conversations API | 2 calls per second | Per professional account |
| Send API, text and links | 100 calls per second | Per professional account |
Read the first row carefully, because it is the one that bites a small account. Your call budget is a multiple of your impressions, so a post that nobody sees buys almost no API calls. Messaging calls are excluded from that count and carry their own per-second limits instead. Meta's own guidance is to avoid the problem rather than manage it: "We strongly recommend using webhooks to prevent rate limiting."
The comment moderation guide publishes no separate cap on replies. In practice the 4800 × impressions budget and the 750 private replies an hour are the two ceilings you plan against.
The three families of tools, and what they cost
Prices read on each vendor's own pricing page on October 20, 2026.
| Family | Examples | Price | What it does to comments |
|---|---|---|---|
| Account drivers | Password-based growth bots | Varies, often $20 to $60 a month | Outbound commenting, outside Meta's terms |
| Schedulers with a comment queue | Buffer, Metricool, Hootsuite, Sprout Social | $5 per channel per month (Buffer Essentials), from $25 a month (Metricool Starter), from $99 a month (Hootsuite Standard), $99 per seat per month (Sprout Social Essentials) | Read and reply, by hand or with saved replies |
| API and agent layers | Zernio, PlugKit | 2 accounts at no cost then $6 per account per month (Zernio) | Read, reply, hide, delete and automate from code or an agent |
PlugKit sits in the third row at $49 a month for 5 connected accounts, cancel anytime, with list_engagement, reply_to_engagement, hide_comment and delete_comment exposed as MCP tools so an agent can triage the queue. Seven days free, no card, one connected account during the trial.
Where the others are better: if you want a human-staffed moderation workflow with assignment and approval, Sprout Social and Hootsuite are built for that and PlugKit is not. If you only need a comment queue next to a calendar, Buffer at $5 per channel is hard to beat. And if what you actually want is outbound commenting on other people's posts, no compliant tool exists, including this one.
A rule engine is not the only shape either. A keyword rule answers "price?" the same way forever; an agent reads the comment and decides. The difference, with the setup, is in Instagram auto reply, and the highest-converting use of a comment is still turning it into a DM, covered in comment-to-DM automation. To see comments and messages in one queue, there is the social media inbox.
FAQ
Is there an Instagram comment bot that works?
For your own posts, yes: reading, replying, hiding, deleting and disabling comments are all official API endpoints, so any tool built on them works and keeps your account safe. For commenting on other people's posts there is no compliant tool, because no endpoint exists for it.
Can I automate comments on Instagram without getting banned?
Yes, if the automation acts on comments on your own media through the official API with instagram_manage_comments. What gets accounts restricted is a tool that logs in as you, especially one leaving many outbound comments an hour. Meta's Platform Terms also forbid a product from collecting your Instagram credentials.
How many comments can I reply to per hour?
The documented ceiling on private replies to post and reel comments is 750 calls per hour per professional account. Public replies fall under the Business Use Case budget instead, which is 4800 times your impressions over 24 hours, so a low-reach account has a smaller allowance.
Do auto comment tools for Instagram need my password?
The ones that comment on other accounts' posts do, because there is no API for it. That is the signal to walk away: Meta's Platform Terms, section 6.a.iii, say an app must not separately request or collect a user's login credentials. Tools that only touch your own comments use OAuth and never see a password.
Can a bot hide Instagram comments automatically?
Yes. POST /<IG_COMMENT_ID> sets the hidden flag, it is reversible, and the author is not notified, which makes it the safest automatic action on a word list. Check the returned flag rather than assuming: an empty value means the platform did not report the state.
One plug for every platform your agent touches
$49 a month for 5 connected accounts, cancel anytime. Every feature in every plan.
Get your API key →