Instagram Graph API: what businesses can and cannot do

Every serious Instagram tool, from schedulers to DM automation, sits on the same foundation: Meta's Instagram API, often called the Instagram Graph API. Knowing what it can and cannot do saves you from buying tools that promise the impossible, and from spending weeks building something the platform will not allow.

This guide is for business owners and developers alike. No code required to follow it.

Which accounts it works with

The API works with professional accounts: business and creator accounts. Personal accounts are not supported for publishing, messaging or insights. Switching an account to professional is free and takes a minute in the Instagram app. Our comparison of business and creator accounts covers which one to pick.

Two ways to connect

Meta offers two login flows, and they lead to slightly different versions of the API.

For most creators and small businesses, Instagram Login is simpler: no Facebook Page, no Business Manager setup. Tools that support it can connect in a few clicks.

What the API allows

With the right permissions, an app can:

• Publish content: single images, carousels and reels, including a first comment right after publishing.
• Read and manage comments: list comments on your media, reply publicly, and hide or delete them.
• Send and receive DMs: inside the rules of the 24-hour messaging window, including buttons, quick replies and product carousels.
• Reply privately to comments: one plain-text message per comment, which is what comment-to-DM automation is built on.
• Receive webhooks: real-time notifications when someone comments, messages you or replies to your story.
• Read insights: account and media metrics for your own account.
• Read your own profile and media: captions, media URLs, timestamps and basic counts.

Each capability maps to a permission the account owner approves when connecting, such as instagram_business_basic, instagram_business_manage_messages, instagram_business_manage_comments, instagram_business_content_publish and instagram_business_manage_insights.

What it will never do

Just as important, and the source of most misleading marketing:

• No cold DMs. An app cannot start a conversation with someone who has not interacted with you.
• No following, unfollowing or liking on your behalf.
• No access to other accounts' private data, such as someone else's follower list or DMs.
• No personal accounts.
• No bypassing limits, such as the number of posts an account can publish through the API in 24 hours (100 at the time of writing).

If a tool offers any of the first four, it is not using the official API. It is logging in as you, which is exactly what gets accounts restricted. The automation rules article explains the difference.

App review: why tools take time to ship features

An app can use any permission on accounts that have a role on the app, such as its own developers and testers. To use a permission on everyone else's accounts, the app needs advanced access, which means passing Meta's app review for that permission.

App review asks for a working demo, a screencast of each permission in use, and an explanation of why the app needs it. Reviews can take days or weeks, and rejections are common on the first try.

For a business evaluating tools, this matters: a feature a tool shows in a demo is only available to you if the app has been approved for the permission behind it.

Tokens and connections

When you connect an account, the app receives an access token. Instagram Login issues long-lived tokens that last about 60 days and can be refreshed while they are still valid. A well-built app refreshes them in the background.

A connection can still break: if you change your password, remove the app in your Instagram settings, or the token expires unrefreshed. When that happens, reconnecting restores it; flows and settings in the tool usually survive.

Building on it yourself

If you are a developer considering a direct integration, budget for:

1. A Meta developer app with the Instagram product added.
2. Webhook infrastructure that verifies signatures and responds quickly.
3. Token storage and refresh, encrypted at rest.
4. App review for every permission you need on customer accounts.
5. Ongoing maintenance, because the API is versioned and older versions are retired on a schedule.

It is very doable, and it is also several weeks of work before the first customer benefits. For many teams, using a tool that has already done it is the faster path.

Instagram automation in Chat33

Connect through Instagram Login and get keyword DMs, comment-to-DM and story reply automation on the official API.