What Is the Instagram API and How Do You Get It? DM Auto-Reply, Comment-to-DM, Tokens and Limits

With the Instagram API you connect a business or creator account to your own software (a bot, CRM, n8n); you reply to DMs, send one private DM to someone who commented on a post, manage comments, and publish posts and reels. It is Meta's official interface. The business can't start the first DM: when the user writes, you reply within 24 hours. There are two setup paths: Instagram Login (no Facebook Page needed) and Facebook Login (Page required). The docs list no fee for the API, and no app review is needed for your own account.

What it does: Connects an Instagram account to a bot, CRM or n8n
Account type: Business or creator account only
Facebook Page: Not needed with Instagram Login
First DM: The business can't start it
Comment-to-DM: 1 message per comment, 7 days
No-code: No; requires n8n or code
Cost: No fee in the docs

What is the Instagram API for?

You have software do the things you do by hand in the Instagram app: incoming DMs and comments reach your software through a webhook (an instant notification Meta sends to your server); the software sends the reply back through the API. Bots, CRMs and e-commerce dashboards connect to Instagram this way.

Auto-reply to DMsWhat you get: Automatic DM replyNeeds a separate setup Private DM reply to commentersWhat you get: Private replyNeeds a separate setup Publish posts and reelsWhat you get: Published postNeeds a separate setup

Feature	Instagram Login	Facebook Login
Facebook Page	Not needed	Required
DM (messaging)	Yes	Yes (through the Messenger Platform)
Comment moderation, publishing, insights, mentions	Yes	Yes
Hashtag search, product tagging, partnership ads	No	Yes
Host	graph.instagram.com	graph.facebook.com

Who it's for: businesses that want fast DM replies, automatic info for anyone who writes "price", comment moderation and scheduled posting, and the developers who set this up for them. It does not work with personal (non-professional) accounts.

How do you get the Instagram API? Setup and access token

Switch your account to a professional account. A business or creator account, from Instagram settings. No Facebook Page needed.
Open a Meta developer account and create an app. At developers.facebook.com/apps, add the Instagram › "API setup with Instagram login" product to the app; the Instagram app ID and secret appear here.
Request permissions. instagram_business_basic, instagram_business_manage_messages, instagram_business_manage_comments, and instagram_business_content_publish if needed.
Get the token. The login flow returns a code valid for 1 hour; the code is exchanged for a 1-hour short-lived token, and that for a 60-day long-lived token. If it's only for your own account, you can get a long-lived token from the dashboard without building a login flow.
Set up the webhook. Define the webhook URL in the app for message and comment notifications and subscribe to the required fields.

Is App Review required?

For your own account or accounts you manage, Standard Access is enough; no App Review needed. If you open your app to other businesses' accounts that have no role in it, you need Advanced Access: App Review and business verification. Testers must have a role in the app and on the Instagram account.

A long-lived token expires after 60 days. It can be refreshed once it is at least 24 hours old and before it expires (refresh_access_token); a refresh gives another 60 days. Tie the refresh to a calendar reminder or an automation, or the bot will silently stop.

How do you set up Instagram DM auto-replies and comment-to-DM?

The user writes or commentsThe webhook arrives at the Webhook node in n8n or at your own server.

The bot prepares the replyAI or a keyword rule; hands off to a human if needed.

The reply goes out through the APITo a DM within 24 hours; to a comment, one private message within 7 days.

With comment-to-DM, if the person doesn't reply, a second message can't be sent.

Add a Webhook node; register its URL as the Instagram webhook in the Meta app and verify it.
Split the incoming event: if it's a DM, pass the text to an AI node; if it's a comment, take the comment ID.
Send the reply with an HTTP Request node to the /<IG_ID>/messages endpoint: for a DM the recipient is the user ID; for comment-to-DM the recipient is the comment ID.

A private reply to the person who commented, on the Instagram Login path:

Private reply to a comment (sample request)

› curl -X POST "https://graph.instagram.com/<VERSION>/<IG_ID>/messages" -H "Authorization: Bearer <ACCESS_TOKEN>" -H "Content-Type: application/json" -d '{"recipient":{"comment_id":"<COMMENT_ID>"},"message":{"text":"Hi! Here is our price list."}}'

DM bot system prompt (example)"You are the messaging assistant for the [Store name] Instagram account. Only answer questions about the store's products, stock, shipping times, return terms and order status; for anything else, say "I can't help with that." If a payment issue, refund, complaint, health or legal question comes up, don't answer; write "I'm transferring you to our team" and hand the conversation to a human. Don't ask for card numbers, and if card details are shared, don't use them. Introduce yourself as an automated assistant. Don't make up prices or stock; if you don't know, hand off to a human. Keep replies short and in English."This text is an example. Meta policy prohibits asking for card numbers in messages and requires a path to a human in automated conversations.

Instagram messaging rules: 24 hours, 7 days and comment-to-DM

Standard messaging window (24 hours)

Human agent window (7 days)

Private reply to a comment (7 days, one message)

Diagram: when the user writes, a 24-hour window opens, during which a bot or agent can write. A human agent can reply for up to 7 days with the human_agent tag. Only one private message can be sent to a commenter within 7 days after the comment.

The business can't start the first DM. A conversation starts when the user sends a DM, mentions you in a story or comments.
Standard window: 24 hours in most cases. Up to 7 days for the first message coming from a Click-to-Direct ad.
Human Agent (7 days): only for replies by a real person (e.g., when you're closed on the weekend). Not for bot replies.
Comment-to-DM (private reply): one message per comment, within 7 days; on live videos only while the broadcast is running. If the person replies, the conversation continues within 24 hours. The message lands in the inbox of followers and in the Requests folder of non-followers.
Rate: sending messages is 100 calls per second for text, links, reactions and stickers, 10 calls per second for audio and video (general limit 2 per second); private replies to post and reels comments are 750 per hour.
Consent and opt-out: Meta policy prohibits messaging without legally valid consent and requires a persistent opt-out path. If the law requires it, you must tell users they are talking to a bot.

Publishing posts and reels with the Instagram API

Create a media container. Pass image_url or video_url to the /<IG_ID>/media endpoint. Meta fetches the file from that URL; the media must be on a public server at publish time.
Publish the container. With /<IG_ID>/media_publish.
Check your remaining quota. With /<IG_ID>/content_publishing_limit.

At most 100 API posts per account in a rolling 24-hour period; a carousel counts as one post.
Images must be JPEG. A carousel holds at most 20 images or videos.
Required permission: instagram_business_content_publish (instagram_content_publish on the Facebook Login path).

Is the Instagram API paid?

Meta's Instagram Platform docs have no fee or pricing page for API calls; usage is limited by access level (Standard / Advanced) and rate limits. They don't explicitly say "free" either. The parts that cost money are usually outside: the server, n8n hosting, the AI model and, if used, Click-to-Direct ads.

No-code tools (Meta partner DM automation tools) charge their own subscriptions; they also use this API.

Using it from Turkey and in Turkish

DMs and replies in TurkishYes	You write the message text in Turkish; the API sets no language restriction.
Developer docs in TurkishNo	The docs are in English.
Turkey-specific restrictionsUnclear	No Turkey-specific restriction is stated in the official documentation.

Data, retention and KVKK

How long it's kept

Meta Platform Terms: you must delete Platform Data as soon as possible when it is no longer needed for a legitimate business purpose, when the user asks for deletion, or when Meta requests it; you must give users an easy way to request deletion.

What it can be used for

In messaging, data about people (other than message content) may be used only to support the message type you chose. You can't use Instagram data without permission just to display content, back it up or manage followers.

Prohibited content

Messages must not ask for card numbers or financial account numbers; it must not be used for patient conversations with healthcare providers; digital products must not be sold.

KVKK

DMs and comments are processed on Meta's infrastructure and on your server. Under KVKK (Turkey's Personal Data Protection Law) Article 9, transfers abroad require an adequacy decision or appropriate safeguards; mention the Instagram channel in your privacy notice. This is not legal advice.

Common issues and fixes

What happens	What to do
My account doesn't appear in the list	The account must be professional (business or creator). If you use Facebook Login, the account must be connected to a Facebook Page and you must have a task on the Page.
The bot suddenly stopped working	A long-lived token expires in 60 days. Refresh it with refresh_access_token before it expires.
I can't send the first message to a user	That's the rule: the user starts the conversation. If they commented, you can send one private reply within 7 days.
A second message doesn't go through in comment-to-DM	You get one private message per comment; if the person replies, you can continue within 24 hours.
Another business's account won't connect	Accounts without a role require Advanced Access: App Review and business verification.
The post won't publish	The media URL must be public and images must be JPEG; check the 100-posts-per-24-hours limit with content_publishing_limit. Accounts pending Page Publishing Authorization (PPA) can't be published to.
Old request messages don't show up in the API	Conversations in the Requests folder that have been inactive for 30 days are not returned by the API.

No-code alternatives

If you don't want to write code, DM automation tools that are Meta partners (e.g., ManyChat) offer the same API through an interface; they come with their own subscription fees. Inbox tools can also connect Instagram DMs.

Frequently asked questions

What is the Instagram API?

Meta's official interface for connecting business and creator accounts to software. It handles DM replies, comment management, comment-to-DM, publishing posts and reels, and reading insights.

How do you get the Instagram API?

You switch your account to a professional account, create an app at developers.facebook.com and add the Instagram product, then request permissions and get an access token. No app review is needed for your own account.

Is the Instagram API paid?

Meta's docs have no fee or pricing page for the API; usage is limited by access level and rate limits. The server, automation tool and AI model may cost extra.

How long is an Instagram API access token valid?

A short-lived token is valid for 1 hour, a long-lived token for 60 days. A long-lived token refreshed when it is at least 24 hours old and before it expires is valid for another 60 days.

Can you set up automatic Instagram DM messages?

Yes. A bot can reply within 24 hours after the user writes. The business can't start the first message, and automated conversations must have a path to a human.

Can you DM everyone who comments?

Yes, one private reply per comment, within 7 days after the comment. If the person replies, the conversation continues within 24 hours; at most 750 private replies per hour for posts and reels.

Do you need a Facebook Page for the Instagram API?

Not on the Instagram Login path. On the Facebook Login path, the professional account must be connected to a Facebook Page; hashtag search and product tagging are only available on this path.

Can you use the API with a personal Instagram account?

No. The API only works with business or creator (professional) accounts.

How many posts per day can you publish with the Instagram API?

At most 100 posts per account in a rolling 24-hour period; a carousel counts as one post. The media must be at a public URL.

Is App Review required?

Not for your own account or accounts you manage. An app that will serve other businesses' accounts goes through App Review and business verification for Advanced Access.

Related guides

Sources

Not clear in the official sources: The docs don't explicitly say API use is free (no pricing page) · App Review duration · Turkey-specific restrictions · a second official page for the publishing limit. Each is covered in the relevant section along with what you can do.