Instagram comment-to-DM automation: a complete guide

Someone comments the word you picked. GUIDE, PRICE, LINK, whatever fits the post. Two things happen next: a public reply lands under their comment so anyone scrolling past sees it answered, then a private message arrives carrying the file or a link to it. Nothing sends to anyone who didn't comment first.

That's the whole mechanic, and it only runs because a real person typed the word under a real post. It's a response to one specific request, not a message built from a purchased list or a follower export. That distinction is what Meta actually reviews before approving an app for this category, and it's worth understanding before you set one up.

Instagram doesn't get polled. The moment a comment posts, Meta fires a webhook, a signed HTTP request, at the server behind the tool, and that's what starts everything downstream. A signature check runs first: a header Meta computes with a shared secret gets checked against what the server computes itself, so a request that only claims to be Meta gets rejected before its content is even read.

From there it's two more calls. A public reply through the comments endpoint, so the thread reads as answered to anyone who scrolls past. Then a private reply through the messaging endpoint, addressed to the person who commented, carrying the file or a tracked link to it. Both calls need the connected account to hold Meta's instagram_business_manage_comments and instagram_business_manage_messages permissions, granted through the account owner's own consent screen, never assumed or defaulted on.

None of this touches a browser. There's no script clicking through the Instagram app pretending to be a person. It's server-to-server calls against endpoints Meta built, documented, and reviewed for exactly this purpose.

Personal accounts can post, comment, and reply exactly like anyone else. What they can't do is read their own comments at scale through the API, or send a message on the account's behalf through it. That's a platform-level restriction, not a limitation of any particular tool. Switching to Business or Creator takes about two minutes inside the Instagram app's account-type setting, and it's free, it doesn't change how a profile looks to followers.

Connecting from there is the OAuth screen you've clicked through on plenty of other apps: Instagram, not a third-party login page, asks you to approve specific permissions. You can revoke them from Instagram's own settings at any time, and nothing broader than comments and messages gets requested.

1. Connect Instagram. Authorize the Business or Creator account through the OAuth screen described above.
2. Pick the post. Choose one existing post, or scope the campaign to every post on the account if managing it per post isn't worth the effort.
3. Set the keyword. Something short and easy to type on a phone. GUIDE works better than SENDMEYOURFREEGUIDEPLEASE.
4. Attach the file and write the reply. Upload the PDF (up to 25 MB), write the public reply text, and write the DM message that carries the link.
5. Launch. The campaign goes live the moment you confirm it. Comment the keyword yourself from a second account first, and watch the whole thing run before a real commenter does.

The window differs by trigger type, not by plan or setting. The table below has the exact numbers.

It matters most when a campaign hits its monthly quota. A comment beyond the limit gets parked, not dropped, and it waits for headroom to open. If that wait runs past the window for its trigger type, the send gets marked expired instead of attempted, because Meta's own API would reject it anyway by then. There's no manual override once that happens. The only way to reopen the conversation is for the person to comment or message again, which restarts the clock from zero.

Keyword matching is instant and free: a whole-word, case-insensitive check against every keyword set on the campaign. "need the GUIDE pls" matches a GUIDE keyword; a comment about a "guideline" doesn't, because the match respects word boundaries instead of just checking whether the letters appear somewhere in the string.

Intent matching exists for comments that never say the word: "can I get this please" under a post that only ever offered one thing. It only runs after every keyword check comes back empty, so an exact keyword never pays for a classification call. Below 0.8 confidence, or if the classifier fails for any reason, nothing matches. That fail-closed default means a shaky read never fires a DM by accident; the worst case is a comment that should have matched, and didn't.

Classification carries a real cost per call, so each plan caps how many run per day: 100 on Starter, 300 on Basic, 750 on Pro, 2,000 on Agency. Keyword matches never count against it.

Two restrictions matter here, and they're different in kind. The first is about what a campaign can ask for: Meta's Spam policy treats "follow this account to get the file" as a form of engagement bait, so hard-gating a lead magnet behind a mandatory follow risks the connected account. A follow gate can still exist as an optional, verified check, Instagram's own is_user_follow_business signal gives a real yes-or-no answer, not a screenshot someone could fake, and ReplyMagnet's own Meta App Review demo ran with it switched off for that reason. Turning it on for a live campaign is a deliberate choice a creator makes, not a posture ReplyMagnet pushes.

The second is about how a tool gets built at all. Anything that opens the Instagram app in a browser or on a device and clicks through it to read comments or send messages looks, to Meta's own detection systems, exactly like the automated behaviour those systems exist to catch. That's a ban risk to the account it runs on, regardless of intent. The Graph API route means Meta reviewed the specific flow before it ever touched a live account, which a browser script skips entirely.

One more thing worth saying plainly: nothing here inflates a number that isn't real. A reply and a DM get logged because they were actually sent, and a follow gets logged because the API actually confirmed it.

A viral post doesn't fail loudly. It fails slowly, on purpose. Every reply and DM reserves one unit of quota atomically before it sends, so two comments landing in the same second can't both slip through on a shared count that hasn't updated yet. Once the monthly quota is used up, the reservation for the next comment simply doesn't happen, and the engagement gets recorded as queued instead of attempted. The workspace owner gets an email at 80% of quota, so a spike doesn't arrive as a total surprise.

Queued engagements release oldest-first, automatically, the moment headroom opens: a new billing cycle, an upgrade, or a manual quota change. Everything gets re-checked at release time too, not just re-sent blindly, since hours or days may have passed: is the account still connected, is the campaign still live, has the reply window for that comment's trigger type run out. A comment that has aged past its window by the time headroom opens gets marked expired instead of sent, for the same reason covered above.

Instagram's own API has rate limits independent of any of this, and a real spike can hit them. Those calls retry automatically with backoff on the error codes Meta uses for throttling, so a temporary rejection slows a batch down instead of failing it outright. It's not instant during a real spike. It's reliable, which matters more.

Nothing on the dashboard is a live counter someone could quietly nudge. A comment that matches produces a match event; the public reply and the DM each produce their own; delivery, once the file is actually reachable, produces one more. If the download page asks for an email or phone number and the person fills it in, that's a separate event too. Every number a campaign shows is an aggregate over those rows, so a disputed count can be traced back to the exact events that produced it.

What you can see and take with you depends on plan. Starter shows leads in-app for the last 30 days with no export. Basic keeps full history and adds a CSV. Pro and Agency add a live push into Mailchimp or Kit. None of that changes what gets recorded, only how far back you can look and whether the list leaves the app.