The Instagram messaging API: what it can and can't do for outreach
The Instagram messaging API lets a business reply to people who messaged it first, usually within 24 hours, and send one private reply to someone who commented on its posts. It can't start a conversation with someone who hasn't contacted you, so it's no use for cold outreach.
Every tool that sends cold Instagram DMs works another way. It logs in to your account and sends as you. Once you know where that line sits, you can tell what any Instagram tool can do and how much risk it carries.
What the Instagram messaging API is
It's Meta's official route for software to send and receive Instagram DMs on a professional account (business or creator). An app gets permission through Meta's login, receives new messages through webhooks and replies through the API. Chatbots, help desks and comment-to-DM tools all run on it. Because Meta allows it, tools built on it are seen as safe.
To use it you need:
- A professional account (business or creator).
- An app approved by Meta with messaging permissions. Meta's docs list
instagram_business_basicandinstagram_business_manage_messages. - A webhook that receives new messages as they arrive.
What it can do
It can answer anyone who messages you within a time window, and it can reply privately to people who comment on your posts. Those replies can carry text, links, images and buttons, and the API can hand a conversation over to a person. For inbound conversations (questions, enquiries, keyword replies) it covers nearly everything a business needs.
These are the main abilities as Meta documents them (read 3 November 2026):
- It replies to people who wrote first. Meta's Send Messages page says an app can message a user "Only after an Instagram user has sent your app user's Instagram professional account a message" (Meta).
- It works inside a window. "For most user actions, it lasts 24 hours." A separate 7-day window applies when a human agent is answering.
- It can send private replies to comments. The business can send one DM to someone who commented on its post, reel, story, live or ad. "Only one message can be sent to the commenter," within 7 days of the comment (Meta).
- It can carry on if the person answers. After a private reply, follow-ups are allowed only if the person responds, and only within 24 hours of that response.
Comment-to-DM is built on the private reply: someone comments a keyword under your post and gets your link in their DMs. Our comment-to-DM page covers it.
What it can't do
It can't message anyone who hasn't contacted you first. The API has no call that starts a DM to a username, lets you message a competitor's followers, or sends a cold message request. It can't follow, like or browse for you either. Any outbound work on Instagram happens outside the official API.
Here is what the official API can't do:
- Send cold DMs to people who haven't messaged or commented.
- Message a list of usernames, however you got them.
- Send follow-ups after the 24-hour window, unless the human-agent case applies.
- Follow, like or comment as part of a warm-up.
How cold-DM tools work instead
Tools that send cold Instagram DMs log in to your account and send as you, through the same private interfaces the Instagram app uses. Some run in your browser, some in a desktop app, and some in the cloud behind a hosted sign-in. All of them act as you, not as an approved business app, and that is where the ban risk comes from.
The ways they connect:
| Method | How it works | Main risk |
|---|---|---|
| Browser extension | Drives Instagram in your own browser | Your computer has to stay on, and the activity sits on your own connection |
| Desktop app | Runs a session on your machine | Same, plus whatever the app stores locally |
| Cloud with password and 2FA secret | Stores your login details and makes its own 2FA codes | The tool can log in as you at any time |
| Cloud with hosted sign-in | You log in on a provider's page, and the tool gets a session | Still acts as you, but never holds your password or code |
When we looked on 3 November 2026, Wave's connect screen asked for the username, password and 2FA "Secret Key". We explain why that matters in Instagram two-factor authentication: why no outreach tool should ask for your code.
What Reddit says
Reddit splits tools into two groups. Official-API tools, the ones that handle inbound replies and comment-to-DM, get called safe. Tools that log in and act like a person are the ones people blame for bans. Users asking for recommendations often say up front that they want the official API.
In an r/socialmedia thread asking for the best automation tool, the original poster wanted an official-API tool that keeps the account safe. We couldn't verify that the account is independent of the tools discussed, so we left its recommendation out. One reply sorted automation into safe and unsafe and put keyword DMs on the safe side: "auto-dms for specific keywords in comments (manychat does this officially)" (u/BruhMoment6423 in r/socialmedia, re-read 3 November 2026). The same reply put tools that simulate human actions on the unsafe side.
The full ledger of what Reddit names, with sellers flagged, is in the best Instagram DM automation tools, according to Reddit.
Which approach fits your goal
If people already message you or comment on your posts, use the official API. It's allowed, the risk is low, and it handles replies and comment-to-DM well. To start conversations with people who don't know you yet, you need a tool that logs in as you, so pick one that limits the risk. Even on the official API, a link in a first message can still get flagged.
A simple way to choose:
- For inbound work (answering DMs, sending a link to commenters, FAQ replies), use official API tools such as ManyChat.
- For outbound work (messaging prospects who haven't contacted you), use a logged-in tool and run it slowly.
- If you need both, use one tool that handles each the right way and keeps replies in one place.
Message requests and the API
A cold DM sent by a logged-in tool arrives as a message request, the same as one you typed yourself. The person sees one message from you until they accept, and people on Reddit report that many never open the requests folder. A private reply to a comment can also land in requests if the person doesn't follow you.
For cold outreach, then, watch how many requests get accepted rather than how many went out. Instagram message requests: how they work covers how requests behave and why most go unseen.
One practical result of these rules: you can't auto DM new followers on Instagram, because a follow isn't a message.