What the Instagram Messaging API actually is
The Instagram Messaging API is not a separate product. It is one part of Meta's Instagram Platform, the same collection of APIs that also handles publishing, comments, and insights. Meta's own documentation describes the Instagram Platform as "a collection of APIs that allows your app to access data for Instagram professional accounts including both businesses and creators." Messaging is one of those APIs, and it only works on professional accounts (Business or Creator). A personal Instagram account has no API surface at all, so if a client's account is still personal, nothing below will work until it is converted.
Any tool that automates Instagram DMs, including ManyChat, Inflowave, or a custom build, is ultimately a wrapper around this API. If the underlying permission, token, or account state is wrong, the tool's own interface will usually look fine while the actual send call fails.
The two login paths, and what each one requires
Meta currently offers two separate ways to connect to the Instagram Messaging API. They are not interchangeable, and a lot of "my automation stopped working" tickets trace back to a setup built for one path running against an account connected through the other.
1. Instagram API with Instagram Login (Business Login for Instagram)
- The Instagram professional account logs in directly with Instagram credentials.
- No Facebook Page needs to be linked.
- Calls go to
graph.instagram.com. - Current permission names:
instagram_business_basic,instagram_business_content_publish,instagram_business_manage_messages,instagram_business_manage_comments.
2. Instagram API with Facebook Login (Facebook Login for Business)
- The user logs in with Facebook credentials.
- The Instagram professional account must be linked to a Facebook Page.
- Calls go to
graph.facebook.com, and messaging runs through the Messenger Platform. - Current permission names:
instagram_basic,instagram_manage_messages, plus Page permissions such aspages_show_listandpages_read_engagement.
Meta deprecated the older short permission names (business_basic, business_content_publish, business_manage_comments, business_manage_messages) on 27 January 2025. If an integration still references those strings, calls to Instagram endpoints will fail outright, not just degrade. This is worth checking first on anything built or last touched before early 2025.
Meta's own guidance on which path to use is straightforward: if an account has "a presence on Instagram only," use Instagram Login. If it is "linked to a Facebook Page," either path can work, but Facebook Login is required for features like hashtag search that Instagram Login does not support.
Required permissions for messaging specifically
| Login path | Core messaging permission | Also typically needed |
|---|---|---|
| Instagram Login | instagram_business_manage_messages |
instagram_business_basic, instagram_business_manage_comments (for private replies) |
| Facebook Login | instagram_manage_messages |
instagram_basic, pages_show_list, pages_read_engagement |
Both permissions cover the same two things: reading conversation threads and messages, and sending messages to someone who has messaged the account first.
App review and advanced access
Standard Access is enough if the app only serves Instagram professional accounts the developer owns, manages, or has explicitly added in the App Dashboard. The moment an app serves accounts it does not own or manage, which is the normal situation for an agency or a CRM selling to multiple clients, Meta requires Advanced Access. Advanced Access requires App Review and Business Verification. This is also why messaging permissions do not get approved on their own: Meta's review process expects the base Instagram permission and any supporting scopes to be requested together with a clear, consistent description of what the app does with them. A submission asking for messaging access with no coherent use case tends to get rejected rather than questioned.
The 24-hour messaging window
This is the rule that causes the most confusion. Meta's documentation states it plainly: "Your app has 24 hours to respond to any message sent from an Instagram user to your app user." In practice this means a business (or its automation) can only send a message to a person within 24 hours of that person's last message. Outside that window, a send attempt fails. The clock resets every time the person sends a new message.
This is a hard constraint on both automation and manual replies. It is why you cannot use the API to send someone a cold first message, and why a lead who went quiet three days ago cannot simply be re-messaged through the API once the window has closed.
The HUMAN_AGENT tag
Meta provides one documented way to extend the window for Instagram: the HUMAN_AGENT message tag. According to Meta's Messenger Platform documentation, this tag "allows a business representative to manually respond to a person's messages" and messages can be sent "within 7 days of the person's message."
The allowed use case is narrow and explicit: human agent support for situations the standard 24-hour window cannot cover, such as a business being closed for the weekend or an issue that takes longer than a day to resolve. Meta's documentation is specific that this is for a human, not a bot, responding, and that message tags generally "may not be used to send promotional content, including but not limited to deals, offers, coupons, and discounts." Using the tag for marketing messages, follow-up pitches, or anything automated is outside the approved use case, and Meta's documentation warns that use of tags outside their approved purpose can result in restrictions on the account's ability to send messages.
Other Messenger Platform tags that exist for Facebook Pages, such as ACCOUNT_UPDATE and CONFIRMED_EVENT_UPDATE, are not available on Instagram. HUMAN_AGENT is the one tag documented for Instagram.
Private replies to comments
A private reply lets a business send a DM to someone who commented on one of its posts, reels, or live videos, or who mentioned the account in a story. This is a separate mechanic from the standard inbox window, governed by its own limits:
- Private replies are allowed within 7 days of the comment or mention.
- Rate limits are 100 calls per second per Instagram professional account for private replies to Instagram Live comments, and 750 calls per hour per account for private replies to comments on posts and reels.
- The reply also carries a reference back to the original comment, so the recipient sees what prompted it.
This is the mechanism behind "comment to DM" automations, including Instagram comment automation tools that trigger a private message whenever a specific keyword appears in a comment. Note that this uses the Instagram Messaging API's private reply endpoint, not the general comment-reply endpoint. The general endpoint can only reply publicly to top-level comments and cannot touch comments on a live video; for a live video, the private reply flow through the Messaging API is the only option.
What message types are supported
Per Meta's documentation, messages sent through the API can contain: text, audio files, images, videos, PDF files, links, Instagram posts owned by the recipient, reactions, stickers, and templates (structured message formats such as button or generic templates). There is no mention of Stories replies as an outbound message type through this API; story replies arrive as inbound messages but are not a documented outbound format.
Rate limits (verified against Meta's published numbers)
Meta publishes several distinct rate limits for Instagram messaging, and they are easy to mix up:
| Call type | Documented limit |
|---|---|
| Conversations API (listing/reading threads) | 2 calls per second per Instagram professional account |
| Send API, text/links/reactions/stickers | 300 calls per second per Instagram professional account |
| Send API, audio or video content | 10 calls per second per Instagram professional account |
| Private replies to Instagram Live comments | 100 calls per second per Instagram professional account |
| Private replies to comments on posts and reels | 750 calls per hour per Instagram professional account |
| General Instagram Platform calls (non-messaging) | 4,800 x number of impressions within 24 hours |
A separate volume cap exists for inbox health rather than API calls: if an Instagram professional account sends and receives more than 72,000 messages, Meta's documentation states new messages stop displaying in the Instagram inbox and the account cannot send new messages until the volume decreases.
The commonly repeated "200 DMs per hour" figure that shows up in a lot of marketing-tool blog posts is not one of Meta's published API rate limits for Instagram. It appears to be a pacing convention some automation tools enforce on themselves, not a documented Meta ceiling. If you see that number quoted as an official Instagram limit, treat it as unverified; it was not present in any Meta developer documentation checked for this article.
If a send fails with error code 613, that is the rate-limit error, and Meta's guidance is simply to reduce call frequency.
Webhooks
Receiving messages and comments in real time depends on webhook subscriptions, not polling. For Instagram messaging, the relevant subscription fields are messages, messaging_optins, messaging_postbacks, messaging_reactions, messaging_referrals, and messaging_seen. A webhook server has to be set up and verified before any inbound message or comment event will reach your app; without it, the API can send messages but your system has no way to know a reply came in except by polling, which is slow and burns rate limit on the Conversations API.
Why Instagram DM automation stops working
Most "it just stopped sending" reports trace back to one of a small set of causes. None of them are usually a code bug.
| Symptom | Likely cause | Fix |
|---|---|---|
| Automation was working, now every send fails | Access token expired or was revoked | Re-authenticate the connection; tokens are tied to the login session and can be invalidated by a password change or security checkpoint |
| Sends fail only for messages older than a day | Outside the 24-hour standard window, no tag applied | Nothing in the API can bypass this for marketing content; only a human-initiated reply inside HUMAN_AGENT's narrow support use case can extend it to 7 days |
| Everything was fine, then all calls started returning permission errors | A required permission (e.g. instagram_business_manage_messages) was removed during a Meta app review cycle, or the app fell out of Advanced Access |
Check the app's permissions in the Meta App Dashboard; resubmit for review if a permission lapsed |
| Automation worked in testing, fails for real customers | App is not in Live mode, or the account was never added under Advanced Access | Switch the app to Live mode in the App Dashboard; confirm Advanced Access covers the account in question |
| Account switched from Business/Creator back to Personal | Personal accounts have no API access at all | Convert back to a professional account; existing permissions and the messaging toggle often need to be re-granted afterward |
| Facebook Page got unlinked from the Instagram account | Facebook Login path depends on that link; losing it breaks the connection | Relink the Page in Meta Business Suite settings, then re-verify the integration's connection |
| No error, but messages silently never arrive via the API or a third-party tool | The "Allow access to messages" toggle in Instagram's own settings was switched off | In the Instagram app: Settings and activity, Messages and story replies, Message requests, Connected tools, then enable "Allow access to messages." This toggle is account-level and can be flipped off by anyone with admin access, a password reset, or a security checkpoint, with no error shown to the app |
| Sends throttle or get rejected under load | Rate limit exceeded (error code 613) | Check which limit applies (Conversations API vs Send API vs private replies) and reduce call frequency or spread load |
| High-volume account, sends silently stop | Account crossed roughly 72,000 messages sent and received, Meta's documented inbox volume ceiling | Wait for volume to decrease; there is no documented override |
ManyChat and third-party tool troubleshooting checklist
Because ManyChat, Inflowave, and similar tools all sit on top of the same API, the same checklist applies regardless of which one you use:
- Confirm the Instagram account is a professional account, not personal.
- Confirm "Allow access to messages" is on in Instagram's own Connected Tools settings. This is the single most common silent failure and produces no error message anywhere in the third-party tool.
- Reconnect the integration if the token is more than a few months old or if there was a recent password change.
- Check whether the message you're trying to send is within the 24-hour window from the person's last message. If not, no third-party tool can force it through; this is an API-level block.
- Check the app's permission grants in Meta's App Dashboard if you manage your own app (agencies white-labeling their own Meta app rather than using a vendor's shared app).
- If a Facebook Page is involved, confirm it is still linked to the Instagram account in Meta Business Suite.
- If sends are being rejected under load, check which rate limit applies before assuming it's a bug.
Instagram business account not connecting to Facebook
This specifically affects the Facebook Login path, where the Instagram account must be linked to a Facebook Page. Common causes: the Facebook Page admin role is missing or was changed, the Instagram account is still set to Personal, the link was made under a different Business Portfolio than the one the app is checking, or a previous link is stuck in a half-connected state that needs to be removed and redone from Instagram's own Account > Linked Accounts menu rather than from the Facebook side. None of this is specific to any one third-party tool; it is Meta's own account-linking layer.
Messages not showing in Meta Business Suite
If messages are arriving on the Instagram app but not in Meta Business Suite's inbox, the two most common causes are the "Allow access to messages" toggle being off, and the Instagram account not being fully added (with full control) under the business portfolio that Business Suite is checking. It is also worth knowing that Meta Business Suite is not a real-time client; it polls for new messages rather than receiving them instantly the way a webhook-based integration does, so a short delay by itself is not necessarily a fault.
Assigning Instagram DMs to team members
Meta Business Suite supports basic conversation assignment: once team members are added under Business Suite's People settings with an appropriate role, conversations in the shared Inbox can be assigned to a specific person, marked done, or labeled. This works across both Instagram and Messenger threads in the same inbox. It is a workable option for a small team handling a single Instagram account, but it does not provide reporting on response times or workload per agent, and it does not merge Instagram with other channels like email, SMS, or WhatsApp. For agencies running DMs as a sales channel, or managing several client accounts at once, that is usually the point at which a CRM-level inbox becomes necessary instead.
Where Inflowave fits in
Inflowave is a CRM that includes Instagram DM automation built on Meta's official Instagram Messaging API, meaning it operates within the same permissions, windows, and rate limits described above rather than around them. Its inbox puts Instagram DMs alongside other channels in one place, and conversations can be assigned to specific team members. Any automation built on it is still subject to the 24-hour messaging window and Meta's rate limits; no tool built on this API can bypass those rules.
Frequently Asked Questions
Is the Instagram Messaging API free?
Meta does not charge for API calls to the Instagram Messaging API itself. Costs come from the tools you build or buy on top of it (a CRM subscription, a developer's time, Meta ad spend if messaging is tied to ads), not from Meta for the API access.
Can I send the first DM to someone with the API?
No. The API only allows sending to someone who has already messaged the account, or who commented on or was mentioned in content (for private replies). There is no documented way to send an unsolicited first message to someone through this API.
What happens if I message someone after the 24-hour window closes?
The send will fail unless the message qualifies under the HUMAN_AGENT tag's 7-day human-support use case, which Meta restricts to live agents resolving an unfinished issue, not marketing or sales follow-ups.
Does my Instagram account need a linked Facebook Page?
Only if you use the Instagram API with Facebook Login. The Instagram API with Instagram Login does not require a Facebook Page at all.
Why did my automation stop working with no error?
The most common silent failure is the "Allow access to messages" toggle in Instagram's own app settings being switched off. It produces no error in third-party tools; messages simply stop arriving.
How many DMs can I actually send per hour?
Meta does not publish a flat hourly DM cap. It publishes per-second limits (300 calls/second for text, links, reactions, and stickers; 10 calls/second for audio or video; 2 calls/second for reading conversations) and a 750-calls-per-hour limit specific to private replies on posts and reels. The "200 per hour" figure circulating online is not one of Meta's documented limits.
Can comment automation reply publicly and privately at the same time?
The standard comment-reply endpoint only posts a public reply and cannot touch live-video comments. A true private reply, which sends a DM referencing the comment, is a separate call through the Messaging API's private reply mechanism, allowed within 7 days of the comment.
Sources
- Instagram API with Instagram Login - Instagram Platform, Meta for Developers, checked 12 October 2026
- Business Login for Instagram - Meta for Developers, checked 12 October 2026
- Send Messages - Instagram API with Instagram Login, Meta for Developers, checked 12 October 2026
- Overview - Instagram Platform, Meta for Developers, checked 12 October 2026
- Send API - Message Tags, Messenger Platform, Meta for Developers, checked 12 October 2026
- Messenger Platform rate limits, Meta for Developers, checked 12 October 2026
- Changelog - Messenger Platform, Meta for Developers, checked 12 October 2026
- Rate Limits - Graph API, Meta for Developers, checked 12 October 2026
- Messenger Platform and IG Messaging API policy, Meta for Developers, checked 12 October 2026
- IG Comment Replies, Instagram Graph API Reference, Meta for Developers, checked 12 October 2026
