Start free

Rules and safety

Is Instagram DM automation allowed?

This is the question that stops most people, and the answer is genuinely reassuring once you know where the line sits. Automation through the official API is something Meta built on purpose. Automation through a logged in browser session is what gets accounts restricted. Almost everything people worry about comes down to which of those two a tool is doing.

Short answer

Yes, Instagram DM automation is allowed when it uses the official Instagram API on a Business or Creator account and only messages people who interacted with you first. It is not allowed when a tool logs in as you, sends cold DMs, or ignores Meta's messaging windows.

What the API permits

  • Replying to a comment on your own post with a direct message, which is what the private reply endpoint exists for.
  • Answering someone who messaged you first, inside the messaging window Meta defines.
  • Posting a public reply under a comment on your own content.
  • Sending links, images and button cards inside a message the recipient started.

What it does not

  • Messaging people who never interacted with you. There is no cold DM endpoint, and any tool offering one is not using the API.
  • Driving the app or the website through a logged in browser session, which is what "no API needed" usually means.
  • Handing your password to a third party. The official flow never asks for it.
  • Sending a second private reply to the same comment, or replying to a comment after the window has closed.

The three limits that shape everything

Any tool built on the official API lives inside these. The difference between tools is whether they enforce them for you or leave you to find out.

One private reply per commentMeta allows a single DM per comment. We track which ones we answered.7 day comment windowA comment older than a week can no longer be replied to. We stop trying.24 hour messaging windowOutside it, a message needs a tag or it is not sent at all.

Where the real risk actually is

Password based tools

If a service asks for your Instagram login rather than sending you to Meta, it is automating a session that looks like a human but never sleeps. That pattern is what triggers restrictions, and the account it costs is yours.

Follow and like bots

Different category, same outcome. Engagement automation has been enforced against for years and it is worth keeping well away from anything touching your messaging.

Ignoring the windows

Retrying a message that Instagram already refused is a good way to look broken to Meta. The correct behaviour when a window has closed is to stop.

Buying a "growth" package

Automated DMs to purchased lists are spam under any reading of the terms, whichever tool sends them.

How to check any tool in one minute

Start the signup. If you are sent to a Meta or Facebook login screen and asked to approve permissions, it is the official API and your password stays with Instagram. If you are asked to type your Instagram username and password into their own form, close the tab.

Then look for the word cold. Any promise to message people who have not interacted with you first cannot be delivered through the API, which means it is being delivered some other way, on your account.

Questions people ask first

Will comment to DM automation get my account banned?

Not when it runs on the official API on a Business or Creator account and respects the messaging windows. Meta built the private reply endpoint specifically so that a public comment can be answered privately. The risk sits with tools that automate the app itself rather than with automation as an idea.

Do I have to disclose that it is automated?

You do not have to label every message, but writing like a human and not pretending to be typing live is the honest version. The most effective automations read like a short note from the person, because that is what people expected when they commented.

What is the 24 hour messaging window?

After someone messages you or triggers a private reply, you have 24 hours to send messages freely. Outside that window a message either needs a specific message tag or is not delivered. A tool that respects this will simply skip the send.

Why does it need a Business or Creator account?

Because the Instagram API only exposes messaging on professional accounts. That is also the mechanism that keeps this legitimate: you approve access through Meta, and you can revoke it from Instagram at any time without contacting us.

How many DMs can I send in a day?

There is no single published number, and anyone quoting one exactly is guessing. Meta rate limits by account and by app, so a tool should back off when it is told to rather than hammering through. Sends that get refused are recorded rather than retried forever.

Platform policy changes. This page reflects how the Instagram API works as we build against it, and Meta's own developer documentation and platform terms are the authority if the two ever disagree.

The version that stays inside the lines

Official OAuth, one private reply per comment, windows enforced in code, and one click to disconnect. See how comment to DM works or read the full FAQ.

Connect through Meta

Ask for it

Still unsure about something?

If there is a policy question this page did not answer, send it over. Questions that keep coming up get added here, which is more useful than answering them one at a time.

No account needed. We only use your email to reply about this request.

Bigger idea, or a build of your own? The full request page has more room.