How Instagram comment-to-DM automation works in 2026: Meta's API, rules and limits

This is what happens between the comment and the DM, using the official API:

1. 1You post and tell people what to comment, for example "Comment GUIDE and I'll send it to you".
2. 2Someone comments. Meta sends a webhook notification on the comments field with the comment ID, the commenter's Instagram-scoped ID and username, the text, the media ID and where the media sits: feed, reel, story or ad. Webhook examples
3. 3The app checks the text for your keyword. Comments without it are left alone.
4. 4On a match, the app sends a private reply: a POST to /<IG_ID>/messages with recipient set to the comment ID. Meta answers with the person's Instagram-scoped ID and the message ID. Private replies
5. 5If the person writes back, a conversation opens and the app can send more messages, such as a link button or a question about their email, within 24 hours of their reply.

Many setups also post a public reply under the comment, like "Sent, check your DMs". That is a separate call to the comment's /replies endpoint from Meta's comment moderation API, and it shows other readers that commenting works.

The login gives the app an access token instead of your password. Under Business Login for Instagram the long-lived token lasts 60 days and can be refreshed once it is at least 24 hours old, so a tool you connect keeps working without you logging in again. Business Login

Size limits for messages

• Text must be UTF-8 and at most 1,000 bytes. Send Messages
• A button template carries up to 640 characters of text and up to three buttons that open a web page or send a postback. Button Template
• Quick replies are limited to 13 buttons, each cut off after 20 characters. Quick Replies
• An account can set up to 4 ice breakers, the questions shown when someone opens a new chat. Ice Breakers

• Cold DMs. Conversations only begin when an Instagram user messages the account. A comment allows one private reply, nothing more. Send Messages
• A second message without an answer. Only one message can go to the commenter, and follow-ups need a response first. Private replies
• Old comments. Comments older than 7 days can no longer get a private reply, and Live comments can't once the Live has ended.
• Automated messages after 24 hours. The human agent tag exists for human support when the standard window isn't enough, for example over a weekend. It is not a way to extend automation. Overview
• Personal or private accounts. The API serves professional accounts, and private accounts get no comment notifications. Webhooks setup
• Group chats and other people's posts. An account can only talk to one person per conversation, and media shared in a message must belong to the account. Send Messages

Tools that ask for your Instagram password or drive the app like a person are outside Meta's API altogether, so none of the rules above protect you there.

The difference matters for what you can send. A comment gets a single private reply, so the link has to be in that one message, or the message has to get the person to answer. A story reply or DM means the person wrote first, so you can send a button that opens your link, then a second message with a question. Webhook examples

You can't change where the message lands, but you can make sure people look for it:

• Say it in the caption: "Comment GUIDE, then check your DMs or message requests".
• Post a public reply under each comment that says the DM is on its way.
• Start the DM with why you're writing, for example "Here's the guide you asked for under my reel", so it reads as expected rather than random. Meta adds a link to the commented post to the private reply as well.
• If you only want followers to get the link, use a follow gate: the first message asks them to tap a button, the app checks the follow and asks others to follow first.

The same split exists in your own inbox. New conversations from people who don't follow you show up under Requests, and they move to General once the app replies. Messages in Requests that sit inactive for 30 days are no longer returned by the API. Send Messages

Source: Meta's rate limiting section. A call over the limit fails with a rate limit error, and the request has to be tried again later.

How to pace without losing anyone

• Set an hourly ceiling below 750 so retries and bursts never push the account to the edge.
• Space messages a few seconds apart instead of firing them in one burst when a reel takes off.
• Keep comments that wait in a queue, in order, and only drop them when they would pass the 7-day limit.
• Back off when Meta answers with a rate limit error, and wait longer each time it repeats.
• Send at most one DM per comment, and remember that the same webhook can arrive twice. Meta says endpoints should handle duplicate deliveries. Webhooks

Pacing keeps you inside Meta's limits. It doesn't guarantee how Instagram treats an account, and no tool can promise that.

• Context first. Name what they asked for and where. People reading it in their requests folder decide in one line whether to open it.
• The link in the first message. Meta documents private replies as text messages, so put the link in the text. Buttons from the button template fit once the person has messaged you.
• Or ask them to reply first. A short question, or a quick reply button, gets an answer that opens the 24-hour window. Then the link can come as a button and extras can follow.
• One ask. If you want an email or phone number for lead capture, ask for that and nothing else.
• Mind the bytes. The 1,000-byte limit counts bytes, not characters, and an emoji takes up to 4 bytes in UTF-8.
• Say it's automated where the law asks. Meta's messaging guide says automated chats must disclose that when applicable law requires it, at the start of a conversation, and names California and German users in particular. Send Messages
• Respect STOP. Honor an opt-out right away and send nothing automated afterwards.

Need a starting point? The free DM template generator writes three versions, a keyword and public replies for your next post.

1. 1A keyword that is an everyday word. YES, LOVE or WANT fire on comments that were never requests. Test yours with the comment keyword checker.
2. 2Not telling people where the DM goes. Without a hint, non-followers often never open their requests.
3. 3Planning a sequence after a comment. A comment allows one message. Every step after that needs the person to answer.
4. 4Automated follow-ups days later. Outside the 24-hour window, only a person may answer with the human agent tag.
5. 5Switching on an old post. Comments older than 7 days can't get a private reply, however many there are.
6. 6A long DM with several links. The 1,000-byte limit is closer than it looks, and three links dilute the one people asked for.
7. 7The same public reply under every comment. A thread of identical replies looks copy-pasted to readers. Rotate a few versions.
8. 8Going live without a test. Comment from a second account first and read the DM the way a follower would.

1. 1Start the free trial. It runs 7 days, needs no card, and your account has to be a Business or Creator account.
2. 2Connect Instagram through Instagram's login. No Facebook Page, and nobody sees your password.
3. 3Pick what starts it: comments on chosen posts or on every post, comments on your Live, replies to your stories, story mentions, or a keyword someone DMs you.
4. 4Set one or more keywords, or answer every comment. Capital letters don't matter.
5. 5Write the DM with your link, using {username} for their name. Choose "Send it right away" or "Ask them to reply first", and add up to three public replies that rotate.
6. 6Add extras if you want them: Only for followers, a DM delay, set hours, your own hourly and daily caps, and email or phone capture on the Business plan.
7. 7Test it with your own second account, then go live.

What Elevion enforces

• One DM per comment, and one per person per campaign.
• Comments older than 7 days are skipped, and older comments are only answered if you switch that on.
• Follow-ups only after the person replies, inside the 24-hour window. Elevion does not use the human agent tag.
• Sending paced well under the 750-per-hour limit, a few seconds apart, with waiting comments kept in line.
• A message of STOP or unsubscribe stops all automated messages to that person.

Creator costs €29.99 a month, or €25.49 a month billed yearly. Business costs €249.99 a month, or €199.99 a month billed yearly. The price is flat, with no fees per contact. See the plans for what each includes.