setscale

Instagram chatbot: what the API lets an AI do in your DMs

October 8, 2026·18 min read
Man around thirty with short sandy blond hair and light stubble, wearing a charcoal grey henley, sitting at an oak counter in a small coffee roastery with jute sacks and warm pendant lights, phone in one hand and laptop open, soft side light, a colleague blurred in the background

An Instagram chatbot built on Meta's official API can answer every DM your account receives, ask qualifying questions in plain language and send a booking link, at any hour. It works under a short set of rules: the account must be a professional one, the person must write first, the bot writes freely only inside a messaging window, and a human must be able to take over at any point.

Those rules live in Meta's developer documentation for the Instagram Messaging API, which Meta also calls Messenger API support for Instagram. One of them moved recently: since an update dated 28 September 2026, the window that opens after a Click-to-Direct ad may last up to 7 days instead of 24 hours. This review reads each rule in Meta's own pages, opened on 8 October 2026, then looks at what an AI changes compared with a bot built on buttons. It is not legal advice.

TL;DR

  • Only Instagram professional accounts, for a business or a creator, can use the API: through a linked Facebook Page, or through the Instagram API with Instagram Login.
  • The bot can only message someone who wrote first. It then has 24 hours, or up to 7 days after a first message sent from a Click-to-Direct ad.
  • After the window, Instagram offers less than Messenger: no one-time notification, no sponsored messages. The Human Agent tag adds 7 days, for replies a person types.
  • A comment earns one private reply, within 7 days. The conversation goes on only if the person answers.
  • Meta requires a path to a human agent, forbids contacting people without opt-in, and its Platform Terms forbid developers to collect your Instagram login credentials.

Table of contents

The Instagram chatbot rules at a glance

Every rule below comes from a Meta page opened on 8 October 2026. The starting point is the Instagram Messaging API documentation, whose overview page carries an update dated 28 September 2026. The other pages are linked in each section.

Rule What Meta's documentation says What it means for an AI chatbot
Account Available for "any Instagram Professional account for a business" and "any Instagram Professional account for a Creator" A personal account cannot be connected
Who writes first "Only after an Instagram user has sent your app user's Instagram professional account a message can your app send a message" The bot answers; it does not prospect
Standard window 24 hours for most actions, up to 7 days after a first message sent from a Click-to-Direct ad Qualify and book inside it
After the window Human Agent tag for manual replies within a separate 7-day period; one-time notifications and sponsored messages "are not available for IG Messaging API" The bot stops; a person may still answer
Comments One private reply, within 7 days of the comment One message, then the person decides
Human escalation Apps "must have an escalation path to a human agent" Every flow needs a way out to a person
Message length Text "1,000 bytes or less" Short answers, split when needed
Credentials Developers "must not separately request or collect a Meta user's login credentials" A tool that asks for your password is outside Meta's terms

Which accounts can use the Instagram Messaging API

A personal account has to be switched to a professional one first; Meta's Business login for Instagram can do that inside the login flow, along with creating a Facebook Page and connecting it. Then there are two technical routes, and a good vendor will tell you which one it uses: a Facebook Page linked to the account, which is the route the Instagram Messaging documentation describes, or, for accounts without a Page, the Instagram API with Instagram Login.

One switch sits on your side, in the app. Meta's getting started guide says professional accounts "will need to enable the connected tools toggle": Instagram Settings, Messages and story replies, Message controls, Connected Tools, then Allow Access to Messages. If a connected tool sees nothing, check that toggle first.

Two points matter once more than one person is involved.

First, who reads the DMs. Meta's Developer Policies, last updated on 3 February 2026, add a rule for Instagram Messaging: before an Instagram account is linked to a Facebook Page, its owner must acknowledge "that all users with a Page role of moderator or higher will have the ability to view and respond to messages sent via Instagram Messaging". For an agency connecting a client account, that is a conversation to have before the connection, not after. The access side is covered in our client account access checklist, and the day to day in the agency playbook for multiple Instagram accounts.

Second, what the tool itself is allowed to do. An app with Standard Access can only interact with people who have a role on the app. A tool that serves professional accounts it does not own or manage needs Advanced Access, which goes through App Review.

Verdict: any professional account qualifies. The questions worth asking are which route the tool uses, whether its app has Advanced Access, and who on your side will see the messages.

The person writes first, then a clock starts

Meta's guide for the Instagram Login route states it plainly: "Conversations only begin when an Instagram user sends a message to your app user through your app user's Instagram Feed, posts, story mentions, and other channels." Your entry points are therefore the ones the person uses:

  • a DM, or a mention of your account in the person's story;
  • an ig.me link, which can carry a referral parameter telling your bot where the person came from;
  • ice breakers, up to 4 frequently asked questions a person can tap to start (not available on desktop, says Meta's ice breakers page);
  • a Click-to-Direct ad;
  • a comment, which opens a narrower door (next section).

Then the clock starts. The overview page, updated on 28 September 2026, says: "For most user actions, it lasts 24 hours. When the user action is a person sending their first message after clicking a Click-to-Direct ad, the window may last up to 7 days from that message." The changelog entry for that date adds that "conversations started through other entry points remain within a 24-hour window."

What happens after the window is where Instagram differs from Messenger. The Messenger Platform and IG Messaging API policy lists the routes outside it, and three of them stop at Instagram's door: one-time notifications, sponsored messages and news messaging "are not available for IG Messaging API". Some message tags work on both platforms and others only on Messenger. The one that matters here, the Human Agent tag, "allows businesses to manually respond to user messages within a separate 7-day period". Manually is the key word: it covers your closer typing a late answer, not your bot.

For an AI setter, the consequence is concrete. Every automated follow up has to fit inside the window. A lead who goes quiet past it cannot be nudged by the bot; only a person can still write, under the Human Agent tag. How to sequence follow ups inside those limits is in our sales follow up process, and the API's other clocks and quotas in Instagram messaging API rate limits.

Two inbox behaviours also change once a tool answers for you, according to the overview: any request you answer through a third-party app moves to the General folder, and conversations left in Requests without activity for 30 days are no longer returned by the API.

Verdict: the window, not the software, decides when your bot may speak. Build the qualification and the booking link into the first exchanges, and treat the 7 days after an ad as a margin.

Comments get one private reply

A comment is not a conversation yet. Meta's private replies page lets your app "send a single message to an Instagram user who commented on the app user's Instagram professional account post, ads post, reel, or live story", with these limits:

  • only one message can be sent to the person who commented;
  • it must go out within 7 days of the comment for a post, an ads post or a reel, and during the broadcast for a live;
  • it lands in the person's inbox if they follow you, in Requests if they do not, and it carries a link to the post they commented on;
  • "Only when the Instagram user responds to the private message can you continue the conversation within the 24-hour messaging window."

The page also lists what the app needs for this feature: the Human Agent feature and Advanced Access. And it warns that a comment on a boosted or ads post "may result in duplicate webhook notifications", so a tool has to make sure the same person does not get two replies.

Verdict: a private reply is one shot. An AI chatbot earns the conversation with a message that invites an answer; it cannot send a sequence until the person writes back.

A human has to stay reachable

This is the rule a bot vendor talks about least, and the overview is explicit: "Apps that use the Instagram Messaging APIs must have an escalation path to a human agent. Experiences can either start by directly interacting with a human agent or can start from an automation to qualify intent but must have a way for users to chat with a human agent as needed."

An automation that qualifies intent is exactly what Meta expects to see in front of the human. The human agent escalation page says an automated experience can escalate "using a fallback intent, keyword, or quick replies", then hand over in two ways: a custom inbox run by the same app, or the Conversation Routing API, which passes thread control to the Instagram Inbox or to another app's inbox. During App Review, Meta asks to see that "thread ownership transfers to the inbox" when escalation happens.

Conversation Routing for Instagram replaced the Handover Protocol: in a changelog entry dated 23 October 2025, Meta wrote that it "no longer supports the Handover Protocol for Instagram". The page lists "Messaging Automation/Bot Applications", described as including "AI agent bots for automated responses", among the apps a business can connect, and gives this example of passing control: "AI support bot passes control to a human customer care agent." Two details are worth knowing: a default application answers when no other app holds the conversation, and the Meta Business Suite Inbox can be that application; and for a conversation started from a Click-to-Direct ad, the designated app keeps control for the length of the window, up to 7 days, unless the ad template sets a value from 1 to 30 days.

For a setter, the clean pattern is short. The AI owns new conversations, qualifies and books. When the lead asks for a person, or when the call is booked and a closer takes over, control passes to the inbox where that closer works. How the roles split on the sales side is in our setter closer model.

Verdict: Meta does not ask you to choose between AI and humans. It asks that the human be one step away, and it checks the handoff during review.

What the API rules out

Four things sit outside the rules, and none of them is a grey area.

  1. Messaging people who never wrote to you. Technically, your app can only message someone after that person has written to the account, using the Instagram-scoped ID that arrives with their message. On the policy side, the Developer Policies say: "Don't contact people in Messenger or Instagram Messaging unless you, or the party to whom you are operating as a Service Provider, have obtained legally sufficient consent, permission, and/or opt-in". They add that "sending spam as defined in the Community Standards is not allowed", including "behavior creating bots either manually or automatically, at very high frequencies". A mass cold DM campaign is not something the official API offers.
  2. Asking for your password. Meta's Platform Terms, last updated on 3 February 2026, say in section 6.a.iii: "You may use Meta Products to authenticate users, but you must not separately request or collect a Meta user's login credentials for any Meta Products." If a tool asks for your Instagram password instead of sending you through Meta's login screen, it is doing what those terms forbid developers to do.
  3. Ignoring a stop. You must "immediately respect all requests (on or off Messenger and Instagram Messaging) by people to block, discontinue, or otherwise opt out of the messaging functionality". When a lead writes stop, the bot stops.
  4. Card numbers in the chat. "Don't share or ask people to share individual payment card, financial account numbers or other cardholder data within messages or calls." A booking flow sends a link; it never collects a card in the DM.

What about the risk to the account? The pages read for this review do not promise that any setup is risk free, and neither will we. What they describe is how restrictions happen: "Use of tags outside of approved use cases may result in restrictions on your ability to send messages", and "messaging or calling experiences that receive excessive negative feedback, may be feature limited, paused, rate-limited or removed from Platform". The same policies ask you to "monitor your block rate".

Want your Instagram DMs answered, qualified and booked without hiring a setter? Start your 7-day free trial.

Telling people they are talking to a bot

The overview repeats the rule of Meta's policy: "When required by applicable law, automated chat experiences must disclose that a person is interacting with an automated service", at the start of a conversation, after a significant lapse of time, and when a chat moves from a human back to the bot. Meta names the California and German markets, suggests wording such as "You are talking to a bot", and recommends disclosure even where the law does not require it.

With a setter, the third moment is the one teams forget: the closer hands the thread back and the bot resumes. Meta does not quote the laws themselves, so check the ones that cover your audience.

What an AI changes compared with a button bot

A button bot runs on the structured features the API offers: ice breakers, quick replies, a persistent menu. The person picks an option and the bot follows the branch. Nothing stops the person from typing a sentence instead, and that is where Meta's Developer Policies set a line that applies to both kinds of bot: "Don't return confusing or nonsensical messages to users or send generic error messages."

Button bot AI chatbot What Meta requires either way
What it reads The option tapped, or an exact keyword The sentence the person typed An answer that is neither confusing nor a generic error
A question off the script A fallback message, often generic An answer drawn from what you gave it The same: no nonsense, no generic error
Escalation trigger A keyword or a "talk to a person" button Recognising the request in plain words, the "fallback intent" Meta mentions A path to a human agent, always
Main failure The polite dead end A confident answer you never approved Monitor your block rate
After the window Silent Silent Human Agent tag, manual replies only

What an AI brings is reading. It can qualify in the lead's own words, notice that "can I just talk to someone" is a request for a human, and answer the question nobody scripted. What it brings as a new risk is the same sentence read the other way: a model that improvises a price, a date or a promise produces a confusing message just as surely as a dead end does. The fix is to give it your script, your offer and your rules, and to read the conversations.

What an AI does not change is the frame. The window, the escalation duty and the disclosure rule stay the same, and the 7 extra days of the Human Agent tag are for a person, not a model. One practical limit matters more for an AI, which tends to write long: text messages must be "1,000 bytes or less", per the send message guide, so long answers have to be split.

Verdict: on Instagram, AI changes the quality of the conversation, not the rules around it.

Before you switch on an Instagram chatbot

  1. Professional account and route confirmed (Facebook Page linked, or Instagram Login), with the Connected Tools toggle on.
  2. Entry points listed: DMs, story mentions, ig.me links with a referral parameter, ice breakers, Click-to-Direct ads, comments.
  3. Qualification and booking inside the first exchanges, because automated follow ups stop with the window.
  4. A human path that works: a keyword and a plain request both reach a person, and the handoff passes thread control to the right inbox.
  5. A disclosure line written for audiences where the law asks for one, repeated when the bot resumes after a human.
  6. A stop that stops: an opt-out word ends all automated messages to that person.
  7. The AI's boundaries written down: what it may say about price, dates and results, and what it hands to a person.
  8. The vendor checked: Meta login screen rather than a password field, Advanced Access for accounts it does not own, and who on your side can read the messages.

The same exercise on the other Meta channels: the WhatsApp AI chatbot rules and the Facebook Messenger chatbot rules for booking calls.

Where SetScale fits

SetScale is an AI setter in DMs for people who sell a service: Instagram today, WhatsApp and Messenger coming soon. It connects through the official Meta API, with no password sharing, and every plan runs the full setter: it qualifies leads, books calls on your free slots and follows up, from one inbox. If a lead asks for a real person, the AI steps aside and you pick up the thread with the context in front of you; if they write STOP, no automated message goes out to them again. The pricing table, read on 8 October 2026, lists an assistant disclosure line, the STOP opt-out and a test simulator on every plan.

You start solo, on one Instagram account and one calendar. When you grow, you add accounts, closers or client spaces without changing tools; the Scale and Business plans add separate client accounts, per client reporting and API, and white label is coming soon.

See the Instagram page, or read our guide to the AI appointment setter.

FAQ

Can an Instagram chatbot message people who never wrote to me? No. Through the official API, your app can only message someone who has written to your professional account first. A comment allows one private reply, within 7 days.

How long can an Instagram chatbot reply after someone writes? For most entry points, 24 hours. After a first message sent from a Click-to-Direct ad, up to 7 days, according to Meta's documentation updated on 28 September 2026. After that, only a person can still answer, under the Human Agent tag, within a separate 7-day period.

Is an AI chatbot allowed in Instagram DMs? Meta's own Conversation Routing page lists "AI agent bots for automated responses" among the apps a business can connect, under the conditions above: the person writes first, a human stays reachable, and the bot discloses itself where the law requires it.

Conclusion

An Instagram chatbot in October 2026 can do most of what a setter does in the first minutes of a conversation: answer, qualify, book. It cannot start the conversation, it cannot chase a lead after the window, and it has to leave a door open to a person. An AI makes the conversation better inside those limits; it does not move them.

Check the route, the toggle, the window and the handoff before you switch anything on, and re-read the overview when its date changes.

Start your 7-day free trial