Comment-to-DM on Instagram's Official API: Webhooks, Private Replies, and Viral Queues

IGMsg — Thu, 12 Nov 2026 05:35:41 +0000

If you have spent any time on Instagram lately, you have seen the ritual: a creator posts a Reel and writes "Comment RECIPE and I'll DM you the link." It works because people will type a keyword faster than they will hunt through a bio. It falls apart the moment the post does well. Unofficial tools that ask for a password or scrape the app are a good way to lose the account you are trying to grow.

There is an official path. Meta's Instagram Messaging API lets a professional account (Business or Creator) send a private reply to someone who commented on a post, Reel, story, ad, or live broadcast. I spent the last year turning that path into IGMsg, a bootstrapped comment-to-DM tool I built as a ManyChat alternative focused only on Instagram. Here is how the API actually behaves, and the product decisions that fell out of it.

You do not poll for comments

The first instinct is to list comments on a media object on a timer. That works for a demo and then you get rate-limited.

Meta expects you to subscribe to Instagram webhooks — the comments field, and live_comments if you care about broadcasts. When someone comments, your server gets the pieces you actually need: the professional account that owns the media, the comment ID, the comment text, the media ID, and the commenter's Instagram-scoped ID and username.

A few operational details matter more than the happy-path payload. Events can arrive in batches of up to 1,000 updates, but batching is not guaranteed, so handle one at a time. If your endpoint does not return a 2xx quickly, Meta retries for up to 36 hours. Deduplicate on comment ID or you will message the same person twice.

Public comment replies (POST /{comment-id}/replies) are a separate call from a private DM. If you want the thread to show "just sent you a DM" so other people comment the keyword too, that is this endpoint, not the Messaging API.

I match on a keyword the creator has already configured — "link", "recipe", "price" — and ignore everything else. That is not an API requirement. It is how you stay useful instead of DMing every "🔥" on a viral Reel.

Private replies are not a normal DM

To send the DM, you POST to the /{ig-user-id}/messages endpoint on graph.instagram.com if the creator connected with Instagram login, or the Page /{page-id}/messages endpoint on graph.facebook.com if they connected through a linked Facebook Page. The important part is the recipient. You do not address the person by their Instagram-scoped ID for this first message. You pass the comment ID:

curl -X POST "https://graph.instagram.com/{version}/{ig-user-id}/messages" \
  -H "Authorization: Bearer {access-token}" \
  -H "Content-Type: application/json" \
  -d '{
    "recipient": { "comment_id": "{comment-id}" },
    "message": { "text": "Here is the link you asked for." }
  }'

Three rules from the docs are easy to miss:

You get one private reply to that commenter in this flow. There is no second shot if your copy is wrong.
You have 7 days from when the comment was created — and only while a live broadcast is still running, for live comments.
The message Meta delivers includes a link back to the commented post. You do not have to invent that deep link yourself.

Where the message lands depends on the relationship: Inbox if they already follow the professional account, or Message Requests if they do not. Unofficial tools that "just log in as you" skip all of this and violate Instagram's terms. We only send through the official Messaging API. The creator connects with Instagram's own login; we never ask for their password.

The 24-hour window opens later than you think

This is the confusion I see most often.

The standard messaging window is 24 hours, and it opens when the person messages you (or takes a similar action, like tapping a call-to-action in the thread). Inside that window you can keep the conversation going, including a link or an offer.

A private reply to a comment does not open that window on its own. Meta is explicit: you may send the one private reply, and you may only send follow-up messages if the person replies, and then only within 24 hours of that reply. Story replies and reactions are different. The person already wrote to the account, so the 24-hour window is open and you use the ordinary Send API with their Instagram-scoped ID, not comment_id.

That split is why a comment-to-DM feature and a story-reply feature share a lot of infrastructure but not the same first API call.

Rate limits, and what a viral Reel actually does to your server

Official Messaging API limits are per Instagram professional account, not just per app:

Private Replies to comments on posts and Reels: 750 calls per hour.
Private Replies to live comments: 100 calls per second.
Send API for text and links: 100 calls per second (lower for audio or video).

750 private replies an hour is plenty for a normal launch, and not enough for the Reel that takes off at midnight. If you fire a request the instant each webhook arrives, you will start getting errors in the exact moment the creator needed you.

The honest implementation is a queue. We accept the webhook, decide whether the comment matches, and enqueue the send. A worker walks the queue under the hourly cap. On a quiet day the DM still goes out in seconds. On a viral day, extras wait and go out as soon as Instagram allows.

The other product rule is even simpler than the rate limiter: one DM per person. The API already gives you a single private reply in this flow. We also collapse it at the person level, so someone who comments the keyword five times still gets one message. That is courtesy, and it is how you avoid looking like spam.

Why I built a ManyChat alternative

I got tired of watching creators copy-paste the same link and lose the lead in a screenshot, with no idea which Reel made the sale. ManyChat can do comment-to-DM, but it is built for many channels and its price moves with your contact count. I wanted something only about Instagram DMs, on the official API, with flat pricing as the account grew.

That became IGMsg. A keyword comment can trigger a DM with a link, an offer, or a freebie, plus an optional public reply. Story replies can get the right link. Commenters land on a lead list you can tag, export, or send to Slack and Notion. On paid plans you can continue the thread after someone writes back, attribute Shopify or WooCommerce orders to the post, and see sends, clicks, and sales per Reel.

It is bootstrapped. We have made about $1,400 in revenue to date and are at $300+ MRR. There is a free plan — 500 DMs a month, three automations, one Instagram account, comment-to-DM and story replies — so you can try it on a real post before you pay. If you would rather use that than build the queue yourself, it lives at igmsg.com.

What I would do if I were starting this weekend

Use webhooks, not polling. Treat comment_id as the recipient for the first private reply, and do not assume you can send a second message unless they write back. Deduplicate webhook retries. Put a rate-limited queue in front of the Private Replies endpoint before you need it. And cap sends at one per person, even when it is tempting to get noisier.

The "comment KEYWORD and I'll DM you" format is not going away. The official API is how you keep up with it without borrowing someone's password.