Instagram Messaging API: the rules, windows and rate limits to know before you send a single DM

Two ways in, and which one to pick

Until 2024 every Instagram integration ran through a Facebook Page linked to the Instagram account. Meta then shipped Instagram API with Instagram Login, which drops the Page requirement and authenticates against Instagram directly. Both paths reach the same messaging capability with different hosts, permissions and prerequisites.

If you are starting today and your users are creators, use Instagram Login — it removes the single biggest onboarding failure, which was users who did not know they needed a Facebook Page. If your users are businesses whose Instagram is already wired into Business Suite, Facebook Login keeps one token model for Pages and Instagram.

Prerequisites that are not in the code

• A professional account. Business or Creator. Personal accounts have no messaging API surface at all; the user switches in Instagram settings, free, and can switch back.
• Message access enabled on the account. In the Instagram app: Settings → Messages and story replies → Message controls → Connected tools → Allow access to messages. If this is off, webhooks never arrive and there is no error — the most common “it worked in testing” support ticket.
• A Meta app with the Instagram product added and a webhook endpoint that answers the verification handshake over HTTPS.
• App roles for testing. Accounts with a role on the app (admin, developer, tester) work under Standard Access. Anyone else needs Advanced Access, which needs App Review.
• App Review for the messaging permission, with a screencast showing the exact flow. Business Verification if the app is for a business, and Tech Provider verification if you send on behalf of other businesses.

The 24-hour window, and the one tag that extends it

A conversation is open for 24 hours after the user’s last message to you. Inside it, your app can send freely — text, media, templates — subject to rate limits. Outside it, a send fails with error code 10, subcode 2534022: message sent outside of allowed window. The clock restarts every time the user writes, reacts or replies to a story.

The only extension Instagram supports is the HUMAN_AGENT tag, which allows a reply up to seven days after the user’s last message. Meta’s conditions are narrow and enforced:

• The message must be typed by a person. Automating sends under the tag is detected and produces an “unsupported message tag” error — and, repeated, an app restriction.
• It must continue a support conversation: resolving an issue, following up on a case. Promotions under the tag are a policy violation.
• It expires at seven days. There is no eighth-day tag, no “one-time notification” opt-in as on Messenger, and no template messages as on WhatsApp.

curl -X POST "https://graph.instagram.com/v26.0/{ig-user-id}/messages" \
  -H "Authorization: Bearer $IG_USER_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "recipient": { "id": "{igsid}" },
    "messaging_type": "MESSAGE_TAG",
    "tag": "HUMAN_AGENT",
    "message": { "text": "Following up on the order you asked about yesterday — it shipped this morning." }
  }'

The igsid — Instagram-scoped user id — is what identifies the recipient. It is unique per user per Instagram professional account, so the same person has a different id in each business’s inbox. You get it from the webhook; you cannot look it up from a username.

What you can send

Private replies are the quiet exception to “they must message first”. A comment on your post or Reel, or on your Live, lets you send exactly one DM to that commenter within seven days. If they reply, the ordinary 24-hour window opens. This is how comment-to-DM automations are legal.

Rate limits, all of them

Instagram messaging is rate-limited per Instagram professional account, not per app, so a busy account cannot starve a quiet one on the same app. The published ceilings:

The 750-an-hour private-reply cap is the one that bites in practice. A Reel that collects 5,000 comments in an hour with a “comment KEYWORD for the link” hook cannot be answered in that hour; queue the replies and spread them over the seven days you have. The 100-a-second text limit, by contrast, is generous enough that hitting it means something is looping.

Webhooks: what arrives and when

Subscribe the app to the messages field at minimum; add messaging_postbacks for template and ice-breaker taps, messaging_seen for read receipts, message_reactions, messaging_referral for ig.me links and ads, and messaging_handover if you pass threads to a human inbox. Every delivery is a POST to your endpoint, signed with X-Hub-Signature-256, that you must acknowledge with a 200 within a few seconds or Meta retries and eventually backs off.

{
  "object": "instagram",
  "entry": [
    {
      "id": "17841400000000000",
      "time": 1757145600,
      "messaging": [
        {
          "sender":    { "id": "5834920000000000" },
          "recipient": { "id": "17841400000000000" },
          "timestamp": 1757145599000,
          "message": {
            "mid": "aWdfZAG1faXRlbToxOklHTWVzc2FnZUlEOjE3ODQxNDAwMDAwMDAwMDA6...",
            "text": "Is the blue one back in stock?"
          }
        }
      ]
    }
  ]
}

Two things in that payload matter more than they look. entry[].id is your Instagram professional account id, which tells a multi-tenant app whose inbox this is. sender.id is the igsid you reply to — and your own outbound messages also arrive as webhooks with is_echo: true, so filter those or you will answer yourself.

Setting it up, end to end

1. 1
   Create the app and add Instagram

   In the Meta developer dashboard create a Business-type app, add the Instagram product, and choose the Instagram Login or Facebook Login path. Register your webhook URL and verify token; Meta sends a GET with a challenge you echo back.

2. 2
   Connect a test account

   Add an Instagram professional account you control as a tester. Complete the login flow, exchange the short-lived token for a long-lived one, and turn on Allow access to messages in the Instagram app.

3. 3
   Subscribe the account to messages

   POST to /{ig-user-id}/subscribed_apps with subscribed_fields=messages,messaging_postbacks. Without this call the app-level webhook is configured but no account is feeding it.

4. 4
   Send yourself a DM and reply through the API

   From another account, message the test account. Read the igsid from the webhook, POST a reply to /{ig-user-id}/messages, and check the 24-hour window logic by waiting a day and watching the send fail with subcode 2534022.

5. 5
   Submit for App Review

   Request Advanced Access on the messaging permission with a screencast of the real flow, a privacy policy URL and a clear description. Complete Business Verification. Expect days to a few weeks and at least one round of clarification.

What the policy forbids, in plain terms

• No cold messages. There is no API path to a user who has not messaged you or commented on your content. Tools that claim otherwise are automating a phone, which is what gets accounts disabled.
• No promotions under human_agent. The seven-day tag is for support follow-ups typed by a person.
• No message scraping. You may store the conversations users have with you; you may not harvest profiles, followers or other users’ content through the messaging surface.
• Automated senders must be disclosable. Meta’s platform terms require that users can tell they are talking to automation and can reach a person.

Where PostMCP fits

PostMCP does not send or read Instagram DMs and has no messaging module. It publishes and schedules Instagram feed posts, Reels and carousels alongside six other networks through one API and an MCP server, which is the other half of the Instagram Platform — content publishing rather than messaging. Teams building a comment-to-DM funnel typically pair a messaging integration like the one above with a publishing pipeline for the Reels that generate the comments; the Instagram API reference and the Instagram scheduler page cover that side.