Instagram DM automation: tools, rules, and the 24-hour window

Instagram DM automation is allowed, through Meta's official Messaging API, with one rule that shapes everything: you have 24 hours after someone messages you to reply freely. Outside that window, Instagram closes the conversation, with one exception, a single private reply to a comment within 7 days. Every tool on the market lives inside those two numbers.

What Instagram DM automation is allowed to do

You need an Instagram professional account (business or creator), an app with the instagram_business_basic and instagram_business_manage_messages permissions, and a user access token. With those, Meta's Instagram Messaging API lets your code read and send DMs on your own account. This is the legitimate path. Automation that logs into the app with your password, scrapes the inbox or mass-DMs people who never wrote to you is the other path, and it is what gets accounts restricted.

Two constraints from the same docs, checked on September 9, 2026:

• You cannot start a conversation. "Messages can only be sent after the customer initiates contact." No cold DM, ever, through the API.
• Group threads are not supported. One to one only.

Text is capped at 1000 bytes UTF-8, images at 8 MB, audio, video and PDF at 25 MB. Message requests inactive for 30 days stop coming back from the API.

The 24-hour window, in one table

The Messenger Platform and IG Messaging API policy sets the timers. Checked September 9, 2026:

Two details people miss. The human agent tag is for a person typing, not for a bot on a timer, and Meta's policy is explicit that "automated bots must respond to user input within 30 seconds". And the private reply to a comment is one message: a second automation matching the same comment will not fire, since Meta allows one private reply per comment.

That single-message limit is the whole design constraint of comment-to-DM. You get one shot, so it has to carry the link and the reason to reply.

DM automation instagram: the four things worth automating

The list of what actually pays:

1. Comment to DM. A keyword in a comment triggers a private message with the link. It converts because the person asked.
2. Story reply follow-ups. A story reply lands in your DMs and opens a 24-hour window. A one-step sequence inside that window costs nothing and doubles replies.
3. Triage. Not answering, sorting. Tag every DM containing a price question, surface unanswered threads older than four hours.
4. The first reply. An instant acknowledgment, then a human. This is the one your audience notices most, and the one most often done badly.

What I do not automate: anything pretending to be me in a real conversation.

Instagram DM automation tools compared

Entry price in USD, taken from each vendor's own pricing page on September 9, 2026. "Comment to DM" means a public comment triggers a private message. "API" means a documented HTTP API you can call from your own code.

ManyChat is the default answer to this question and it is missing from the table on purpose: manychat.com returned a 403 to my fetch again on September 9, 2026, and I only publish prices I pulled from the vendor myself. Its plans are contact-tiered, so a viral reel moves your bill. The rest of the field is in ManyChat alternatives.

Three billing models hide in that table. Per-conversation and per-subscriber pricing (Chatfuel, SendPulse, ManyChat) turns a good week into an invoice. Per-seat pricing (respond.io) is for teams where humans do the answering. Per-account pricing (Zernio, PlugKit) stays flat whatever happens to your reach, and it is the only one an agent can run against without you watching the meter.

Where the others are better: Chatfuel and ManyChat have visual flow builders that a non-developer can use on a Sunday afternoon, and PlugKit has none. If you want to draw a decision tree with boxes and arrows, do not buy an API.

Instagram Graph API business account DM automation, without writing the OAuth part

The Meta path is real work: app review, permissions, token refresh, webhook verification, then a different implementation for every other platform you touch. What an aggregator sells you is skipping that.

Here is a comment-to-DM automation created through the PlugKit API, which handles the Meta side:

curl -X POST https://api.plugkit.co/v1/comment-automations \
  -H "Authorization: Bearer sk_..." \
  -H "Content-Type: application/json" \
  -d '{
    "accountId": "acc_123",
    "name": "Guide lead magnet",
    "keywords": ["guide", "link"],
    "matchType": "contains",
    "dmText": "Here is the guide I mentioned in the reel.",
    "dmButtonLabel": "Get the guide",
    "dmButtonUrl": "https://www.plugkit.co/",
    "publicReplyText": "Sent, check your DMs.",
    "oncePerUser": true
  }'

Keyword matching is case and accent insensitive. mediaIds left empty watches every post on the account. oncePerUser defaults to true, which is what you want: one person, one DM, whatever they comment.

Replying inside an existing conversation is POST /v1/inbox/conversations/{id}/messages with a text field. On Instagram and Facebook that call works within the 24-hour window and fails outside it. On WhatsApp, an approved template takes over past the window. Same endpoint, different platform rule, which is the part an aggregator earns its money on.

Why your link belongs in a button

Bare URLs in a first DM get filtered. Every automation in the table above sends links as a button with a label, and PlugKit caps that label at 20 characters because Meta does. It is not cosmetic: a message body with a raw link, sent automatically to someone who just commented, looks exactly like spam to Meta's classifier and often to the recipient.

The rest of the flag surface is covered in Instagram automation in 2026: what Meta allows, what gets you flagged, including what a restriction notice actually looks like.

Letting an agent handle the inbox

The tools above run rules you write in advance. An agent reads the thread and decides. Since early 2026 that is a practical option: connect an MCP server to Claude, Cursor or Hermes, and the model gets list_conversations, send_message and reply_to_comment as tools. The setup takes one command, claude mcp add -t http plugkit https://api.plugkit.co/mcp, and I wrote the full walk-through in the Hermes Agent setup guide.

My rule with an agent on the inbox: read-only for a week. Let it draft and summarize, keep the send button on the human side, then hand it writing rights on one account. The 24-hour window is unforgiving of a bad first message and there is no undo on a sent DM.

More on where each platform's API stands, and what an agent can do with it, on the Instagram automation hub.

What this costs

Meta Business Suite is included with your account and covers instant replies and keyword answers with no code. Beyond that, you are paying for the API layer. PlugKit is $29 a month for 5 connected accounts, cancel anytime, with the unified inbox, comment-to-DM automations, broadcasts, sequences, analytics, webhooks and the MCP server on every plan, or $97 a month for 30 accounts with extra accounts at $3. X API calls are the only pass-through, billed at X's own rate, $0.005 a read and $0.015 a publish.

FAQ

Is Instagram DM automation against the rules?

No, when it runs on Meta's official Messaging API with a professional account and the right permissions. What breaks the rules is automating the app itself: logging in with your password, scraping the inbox, or sending unsolicited DMs to people who never contacted you. The API physically cannot do that last one, since a conversation only opens after the user writes to you.

How do I automate Instagram DMs for free?

Meta Business Suite, at no cost, gives you an instant reply to the first message, an away message, automated responses on up to 5 keywords and up to 5 saved answers to frequent questions, on Facebook, Messenger and Instagram. It has no comment-to-DM trigger and no API. That is the free ceiling, and for many creators it is enough.

What is the 24-hour rule on Instagram DMs?

You may send free-form messages, promotional content included, for 24 hours after the person's last message to you. After that Instagram closes the window. A human can still send one reply with the human agent tag for up to 7 days, and a comment on your post entitles you to one private message within 7 days.

Can I send an automated DM to someone who commented?

Yes, one message, within 7 days of the comment, and only one per comment. That is Meta's private reply rule, and it is why comment-to-DM tools put the link in a button in that first message. If the person replies, a normal 24-hour window opens and you can talk.

Do I need a business account for Instagram DM automation?

Yes. A professional account, business or creator, is required by the Instagram API with Instagram Login, along with an app holding instagram_business_basic and instagram_business_manage_messages. Personal accounts have no messaging API at all.

AB

Antoine BlancoFounder of PlugKit. Runs his own Instagram, YouTube and X accounts through the API and MCP server described here.