Instagram Auto Reply to Comments: Triggers, Setup, and Limits

Instagram auto reply to comments runs on two documented paths, and choosing between them is most of the setup. A public reply posts a visible answer inside the comment thread — fast, and anyone reading the post sees it. A private reply sends the commenter a DM, which is the only documented option for live video comments and hidden comments, though it's capped at one message per commenter within seven days. What to try next: pick one keyword, write one reply for it, and test it on a single post before wiring up anything else.

Below is the practical version — what each path actually does, where it breaks, and the setup worth running through first. The examples are hypothetical; the endpoints, permissions, and timing rules are Meta's own.

Public comment replies via the Graph API#

Reach for a public reply first, because it answers in the thread where the question was asked. The answer is visible to everyone browsing, it reads like a normal interaction, and it needs less machinery than a DM flow. The whole documented call is a single POST to /{ig-comment-id}/replies with your text in a message parameter — that's the entire surface area in Meta's IG Comment Replies reference.

POST /{ig-comment-id}/replies?message=Yes! Our gluten-free menu is in the link in bio.

One detail worth stating plainly: ig-comment-id is the comment you're answering, not the post. You get that ID from the comment webhook, so a public-reply flow and a webhook subscription are really the same project.

The threading rule that trips people up#

You can only reply to top-level comments. If you try to reply to a reply, Meta doesn't nest it — the new reply gets added to the top-level comment instead, according to the official reply endpoint docs.

Hypothetical example: a customer asks "Do you have a gluten-free menu?" on your reel. You reply "Yes! Link in bio." They reply "Which location?" Your next answer lands beside the original question, not under your reply. Visually it reads like you answered a different person.

What it takes to post one#

Meta's docs specify a User access token from a User who created the comment, with instagram_basic, instagram_manage_comments, pages_show_list, and page_read_engagement in scope, as listed on the same reference page. Read that wording closely — the token has to belong to the person who wrote the comment.

That's a real constraint, and it's the reason "auto-reply to every comment" is harder than it looks. The documented path covers comments authored by a user you hold a token for. For comments from strangers, the private-reply path further down is the one Meta documents end to end, and it's the path most comment-to-DM tools are built on.

One caveat: that reference page carries a Nov 9, 2021 date, so treat the permission names as a starting point and confirm the current list in your own Meta app dashboard before you build against it.

What cannot be replied to#

Four documented dead ends account for most "my bot ignored that comment" moments. They show up eventually in every real comment folder.

• Hidden comments. When a comment is hidden, there is no public reply to post — Meta is explicit that you cannot reply to hidden comments in the IG Comment Replies reference.
• Comments on a live video. Also closed to the public replies endpoint. The same page points you to the Instagram Messaging API and a private reply instead.
• Deleted threads. You cannot read the replies to a comment that has been deleted, per that reference documentation, so there's nothing left to answer.
• Fixing a mistake. Updating a reply is not supported, and deleting a reply is not supported either. If your auto-reply sends the wrong price, you can't patch it with the API — a human has to remove it in the app.

Two consequences follow. First, plan for comments that can't get a visible answer; most teams route those to a DM rather than letting them vanish silently. Second, because there's no edit or delete, the wording of your replies matters more than you'd expect. A slightly wrong automated reply is permanent until someone removes it by hand.

Private replies as the fallback path#

Here it is in plain terms: your app subscribes to comment events. When someone comments, Meta sends your server a webhook notification with the comment's ID and the commenter's details, as described in the private replies documentation. Your server decides whether to respond, and if it does, it sends a POST to APP_USERS_IG_ID/messages with the comment's ID as the recipient and your text as the message — again, straight from that same page.

POST APP_USERS_IG_ID/messages?recipient={comment-id}&message=Here's the free guide: https://example.com/guide

The recipient is the comment ID, not a username. That's the second reason the webhook matters — it's where the comment ID comes from in the first place.

When it's the only documented option: live video comments and hidden comments. In both cases the public endpoint is closed to you, and the docs point at private replies as the route.

Hypothetical: a creator posts a reel — "Free 30-day meal plan, comment GUIDE." Someone comments "guide". The webhook fires, one DM arrives with the link, and nobody in the comment thread gets spammed. The mechanics of that pattern are unpacked further in how Instagram comment-to-DM automation actually works.

Timing and message caps#

Three numbers to keep in your head, and all three come from Meta's private replies documentation.

1. One message per comment thread. Only one message can be sent to the commenter, per the private replies reference.
2. Seven days. Your app can send that private reply within seven days of the comment's creation time, according to the same documentation.
3. Live is different. Except for Instagram Live, where replies can only be sent during the live broadcast. Follow-up messages only go out if the recipient responds, and must be sent within 24 hours of that response — both stated in the private replies docs.

Keep the scope straight: those caps belong to private replies. Meta's public replies page states no equivalent limits — and neither page publishes a rate limit, quota, or version policy for comment replies, so don't design around a throughput number that isn't documented anywhere.

Day to day, that means a DM queued overnight still has room the next morning, while a DM drafted three weeks later is dead on arrival. A live comment that lands two minutes after you end the stream has no documented path at all.

Designing keyword triggers#

One expectation-setter before you design anything: Meta documents the endpoints and the limits, but it does not define keyword or trigger conditions for auto-replies. There's no official rule set for what counts as a match, no documented ordering, and no published retry behaviour. That layer is yours to build — which is good if you want it to sound like your business, and a warning if you expected Instagram to police it for you.

The shape is simple: the webhook delivers comment text and comment ID, your rules decide match or no match, then your rules decide public reply, private reply, or nothing at all.

A hypothetical rule set for a food account: "menu" or "gluten free" gets a public reply pointing to the menu. "guide" or "freebie" gets a private reply with the link. "do you deliver to…" gets no auto-reply and gets flagged for a human. Anything else gets nothing.

Match on intent rather than tokens alone. "Do you deliver to Leeds?" and "nobody delivers to Leeds, lol" contain the same keyword; if your rule fires on both, you'll look automated instantly. Checking for a question mark or a stop word is cheap insurance.

Also decide what "nothing" looks like. A bot that answers every comment teaches people to ignore it, and silence on a random emoji is perfectly fine. Give one rule two exits when it makes sense — a public reply for the answer plus a DM for the details is the shape most comment-to-DM setups use. And keep a human list for price negotiations, complaints, or anything involving a delivery promise.

If you'd rather not build that rules layer yourself, AutoDM, a free Instagram comment-to-DM app, advertises keyword-triggered comment replies, story replies, and repeat protection as product features. That's the vendor's own claim rather than something Meta specifies, and not something this article tested.

Setup checklist before automating#

Run through this once, in order. Most broken auto-replies turn out to be a skipped item here rather than a bug in the trigger logic.

1. Connect a professional account. Use a Business or Creator account rather than a personal one — the Graph API comment endpoints are built for professional accounts.
2. Permissions in scope. Your token needs instagram_basic, instagram_manage_comments, pages_show_list, and page_read_engagement, per Meta's comment replies reference. Confirm current names in your dashboard — that page is dated Nov 9, 2021.
3. Check token ownership. For public replies, Meta specifies a User access token from a User who created the comment. Verify this before you promise auto-replies on customer comments.
4. Subscribe the webhook to comment events and return a fast success response so Meta doesn't retry the delivery.
5. Capture the comment ID. You need it to reply publicly, and to address a private reply as the recipient.
6. Token flow. The access token comes through Meta's OAuth login flow for the connected account; a token that isn't connected to the right account will fail at send time, not at setup time.
7. One trigger, one reply, one post. Test on a single piece of content until the timing feels right, then widen.
8. A fallback queue. Anything your rules don't match should land somewhere a human sees it.

Failure cases and troubleshooting#

Six failures account for nearly every broken setup.

Permission error on send. Wrong token owner, or a missing scope. Work back through steps two and three of the checklist — this is a setup problem, not a trigger problem.

The reply lands at the top of the thread instead of under your earlier reply. That's the flattening rule working as documented, not a bug. Plan your conversation around top-level replies rather than expecting a nested chain.

The private reply never arrives. Either one message already went out in that thread, or you're outside the seven-day window. Both limits are stated in Meta's private replies documentation.

The follow-up won't send. Follow-ups require the recipient to respond first, and must go out within 24 hours of that response, per the same page.

Live video comments go unanswered. Public replies are closed for live, and private replies only work during the broadcast — the reply endpoint docs and the messaging docs both spell that out.

Hidden comments trigger nothing. You can't reply to them, and there's no state to recover afterwards.

And one failure that isn't an error at all: there's no API to update or delete a reply, per the IG Comment Replies reference. A wrong auto-reply becomes a manual cleanup job, which is the strongest argument for keeping automated replies short and safe. If a message could be wrong, don't auto-send it. For a wider look at where automation genuinely helps and where it quietly doesn't, the technical reality of Instagram comment-to-DM automation is worth ten minutes.

Starting point for today: pick your single most common question — the menu, the price, the free guide — and write one reply for it in your own voice. Run it on one post, watch which comments actually match, then widen the rules. If something misbehaves, it's almost always the token ownership step worth reading twice.