Instagram DM API: how to send and automate Instagram DMs

By Nemanja Divjak, founder of Chat33October 15, 202612 min read

Glass panels of abstract code connected by glowing lines to orange and white chat bubbles

There is no product called "the Instagram DM API". When people search for it, they mean the messaging part of Meta's Instagram Platform: the endpoints that let an app receive Instagram direct messages, answer them, and send a private reply to someone who commented on a post. It sits on the Graph API, uses the same access tokens as publishing and comments, and comes with a set of rules that decide most of what you can build.

This guide is for developers and technical marketers who want to send or automate Instagram DMs from their own code. It covers how the API is put together, what an account and an app need before the first message goes out, the timing rules, and the things it will not do no matter how you ask. At the end there is a short, honest section on when it makes sense to use a layer like Chat33 instead of building everything yourself.

For a wider tour of the platform beyond messaging, read our Instagram Graph API guide first.

What the Instagram DM API actually is

Meta exposes Instagram messaging through two doors that lead to mostly the same place:

Instagram API with Instagram Login. The account owner logs in with Instagram itself. No Facebook Page is involved. Calls go to graph.instagram.com.
Instagram messaging through Facebook Login (historically documented as the Messenger Platform for Instagram). A Facebook user who manages a Page linked to the Instagram account logs in, and the app works with Page access tokens on graph.facebook.com.

Both give you the same core pieces: a Send API to post messages into a conversation, a Conversations API to read threads and messages, webhooks that push new messages and comments to your server, and private replies to comments. Message types include text, images and other media, quick replies, buttons and generic templates (product-style cards), within each type's limits.

Which door to use is mostly about who your users are. Creators and small businesses that live on Instagram usually prefer Instagram Login, because there is no Page or Business Manager setup. Businesses that already run everything through Meta Business tools, or that also want Facebook Messenger in the same app, often end up on Facebook Login.

Account requirements

Before any API call matters, the Instagram account itself has to qualify:

It must be a professional account, either business or creator. Personal accounts are not supported for messaging. Switching is free in the Instagram app, and our business vs creator comparison helps you pick.
With Facebook Login, it must be linked to a Facebook Page, and the person logging in needs a role on that Page that lets them manage messages.
Message access for connected tools has to be allowed. Instagram has a setting under message controls that lets connected apps access messages. If it is off, your webhooks stay quiet and nobody can tell why. Check it first when debugging.

Permissions you need

Each capability maps to a permission the account owner grants when connecting your app. The names differ between the two login types.

What you want to do	Instagram Login	Facebook Login
Basic profile and media	`instagram_business_basic`	`instagram_basic`, `pages_show_list`
Read and send DMs	`instagram_business_manage_messages`	`instagram_manage_messages`, `pages_manage_metadata`
Read comments, reply, private replies	`instagram_business_manage_comments`	`instagram_manage_comments`

Facebook Login apps often also need business_management, and Meta's Private Replies documentation lists pages_messaging for that feature. Meta renames and regroups permissions from time to time (the Instagram Login scopes replaced older business_* names in late 2024 and early 2025), so treat this table as a starting point and confirm against the current permissions reference on developers.facebook.com before you submit anything.

App Review and Advanced Access

Every permission has two access levels. With Standard Access, your app can use a permission only on accounts that have a role on the app: you, your developers and your testers. That is enough to build and test the whole thing.

To use a permission on anyone else's account, you need Advanced Access, which means passing App Review for that permission. Review asks for a working app, a screencast that shows each permission being used end to end (usually starting from login and connecting the account), and a written explanation of why you need it. Business verification is typically required as well.

Plan for it to take time. Reviews can come back in days or drag on for weeks, and a rejection on the first attempt is common. The usual causes are a screencast that skips steps, or a use case the reviewer cannot reproduce. Until it passes, your product works for your test accounts and nobody else.

Webhooks: how you hear about new messages

The API is event-driven. You do not poll for new DMs. You register a webhook URL, verify it once with a challenge Meta sends, and subscribe to fields such as messages and comments (plus others for postbacks, reactions and seen events).

From then on, Meta sends a POST to your endpoint for each event. A few things matter in practice:

Verify the signature on every request with your app secret before trusting it.
Answer fast with a 200 and do the real work in a queue. Slow or failing endpoints get retried and, if it keeps happening, can be disabled.
Expect duplicates and echoes. Your own outgoing messages can arrive as echo events, and retries can send the same event twice, so deduplicate by message id.

Comment webhooks are what comment-to-DM automation is built on: a comment arrives, your code checks it for a keyword, and it sends a private reply.

The 24-hour messaging window

This is the rule that shapes everything else. When a person messages your account, a 24-hour window opens. Inside it, your app can send them messages, including promotional ones. Each new message from them restarts the clock. Once it closes, standard messages are refused until they write again.

There is one exception worth knowing about: the HUMAN_AGENT tag. It lets a real person on your team answer up to 7 days after the user's last message, for cases where a human genuinely needs more time. It is not a free pass for automation. Your app needs the Human Agent feature approved by Meta through App Review, and the message must actually come from a human. Sending automated follow-ups with the tag is against the policy.

Our article on the 24-hour messaging window goes deeper into what opens and resets the window and how to plan follow-ups that still land.

Private replies to comments

A private reply is a DM sent in response to a comment. It is how a "comment GUIDE and I'll DM you the link" post works, and it has its own rules:

One message per comment. You get exactly one private reply. The conversation only continues if the person answers it, and their answer opens a normal 24-hour window.
Within 7 days of the comment for posts, reels and ads. Comments on live broadcasts can only get a private reply while the live is running.
It goes to the commenter only, referenced by the comment id, not by their user id.

Because you only get one shot, that single message has to do the work. Most good comment-to-DM flows put a button or a question in it, so the person has an easy reason to reply and open the window. If you want the public side too, a separate public reply under the comment is allowed and shows other viewers that DMs are going out.

Instagram comment-to-DM in Chat33

Keyword comment triggers, private replies, public reply variants and DM flows on the official Instagram API, set up in a visual editor.

Rate limits

Meta publishes per-account limits for messaging, and they change, so check the current rate limiting page before you size anything. At the time of writing, the documented limits for Instagram professional accounts include roughly 300 Send API calls per second for text and links, about 10 per second for audio or video, 2 per second on the Conversations API, and 750 private replies per hour for comments on posts and reels. The Send API can also be throttled when too many messages go to a single thread.

For most accounts these numbers are generous. Where they bite is a viral post with thousands of keyword comments in an hour, which is exactly when you want a queue that spreads private replies out instead of failing in a burst.

What the API cannot do

This list matters more than the feature list, because it is where misleading marketing lives:

No cold DMs. You cannot message someone who has never interacted with the account. There is no endpoint to start a conversation with an arbitrary user.
No bulk messaging outside the window. Broadcasting to everyone who messaged you last month is not possible with standard messages.
No new-follower trigger. The API does not tell you when someone follows you, so "DM every new follower" cannot be built on the official API.
No personal accounts and no access to anyone else's inbox or follower list.
No following, liking or other actions on the account's behalf.

If a tool promises any of these, it is not using the official API. It is logging in as you, which is the fastest route to a restricted account. Our guide to automation rules covers the difference in more detail.

Build it yourself or use a layer

Building directly on Meta's API is very doable. The work is less in the Send API call itself and more in everything around it: a Meta app, login and token refresh, encrypted token storage, a webhook receiver with signature checks and deduplication, a queue for rate limits, window tracking per conversation, App Review for each permission, and keeping up with API version retirements. For a team that needs deep custom behavior, that investment can be worth it.

If what you actually want is to automate DMs or plug Instagram messages into your own product, a layer that has already passed review gets you there faster. Chat33 is one option. It connects Instagram and Facebook accounts through the official API and exposes a REST API, a message webhook and an MCP server on top:

Flows API. Create, update and switch on comment-to-DM and DM keyword automations as a graph of nodes. The same flows open in the visual editor.
Inbox API. List conversations, read messages and reply. A reply outside the 24-hour window comes back as a clear window_closed error.
Comments API. List comments on a post and reply publicly or with the one private reply.
Message webhook. Every incoming DM is pushed to your URL as a signed message.received event, so your own bot can answer it.
MCP server. Lets AI assistants such as Claude list flows, read conversations and reply, with OAuth sign-in. Setup is on the MCP page.

Calls go to https://chat33.io/api/v1 with an API key in the x-api-key header. Replying to a conversation looks like this:

curl -X POST https://chat33.io/api/v1/conversations/CONVERSATION_ID/reply \
  -H "x-api-key: sk_live_..." \
  -H "Content-Type: application/json" \
  -d '{"message": "Thanks for reaching out! Here is the link you asked for."}'

And this is the shape of the event your server receives when someone sends a DM:

{
  "event": "message.received",
  "id": "evt_...",
  "createdAt": "2026-10-15T09:30:00.000Z",
  "data": {
    "platform": "instagram",
    "channel": { "id": "ch_...", "name": "yourbrand" },
    "conversationId": "conv_...",
    "message": { "id": "msg_...", "text": "price?", "attachments": [], "sentAt": "2026-10-15T09:30:00.000Z" },
    "contact": { "id": "ct_...", "externalId": "...", "name": "Jane", "username": "jane", "optedOut": false },
    "replyWindowEndsAt": "2026-10-16T09:30:00.000Z"
  }
}

The same Meta rules still apply underneath: no cold DMs, one private reply per comment, and replies only inside the window. A layer removes the plumbing, not the platform rules. Inbox and comment scopes are opt-in on each API key, and the full reference is on the developers page and in the OpenAPI spec.

If you are comparing tools for this, our ManyChat alternative guide has a checklist for API access specifically.

Frequently asked questions

Is there an official Instagram DM API?

Yes, as part of Meta's Instagram Platform. It is not a separate product: messaging is a set of endpoints and webhooks available through the Instagram API with Instagram Login, or through Facebook Login with a linked Page. Both require a professional Instagram account.

Can I send a DM to any Instagram user through the API?

No. The API only lets you message people who have interacted with the account first, by sending a DM, commenting (one private reply), or replying to a story, for example. There is no endpoint for cold outreach.

Do I need a Facebook Page to use the Instagram DM API?

Not with the Instagram API with Instagram Login. You do need one if you connect through Facebook Login, because that version works through the Page linked to the Instagram account.

How long does App Review take?

There is no fixed answer. Some submissions pass within days, others take weeks with a rejection or two in between. A complete screencast that shows the full login and each permission in use is the single biggest factor you control.

Can I use the HUMAN_AGENT tag for automated follow-ups?

No. The tag exists so a human can answer within 7 days of the user's last message, and it requires Meta to approve the Human Agent feature for your app. Using it for automated or promotional messages breaks the policy.

Can the API trigger a DM when someone follows me?

No. The official API has no follow event, so no legitimate tool can DM new followers automatically. Comment keywords, DM keywords and story replies are the triggers that do exist.

Is the Instagram DM API free?

Meta does not charge for the API calls. The cost is the engineering time to build and maintain the integration, plus App Review. Tools built on top of it charge for the product around the API, not for access to Meta's endpoints.