Instagram DM automation works in four steps: someone engages with your post, Meta notifies the tool through a webhook, the tool matches that engagement against a rule you set, and the reply goes out. The chain takes seconds, not minutes, and it only ever starts with something the other person did.
That last part is the whole design. Instagram's platform is built around responding to engagement, not initiating contact, and almost everything that follows is a consequence of it.
What starts an automation
Three things can start one, and they are the only three:
- A comment on a post or reel. The most common trigger. Usually matched against a keyword, "comment LINK and I'll send it", though it can fire on any comment.
- A reply to a story. A story reply is an ordinary direct message that happens to be attached to a story, which is why it behaves like a DM rather than like a comment.
- A direct message containing a keyword. Someone messages you the word "price" and the automation answers.
There is no fourth trigger, and the gaps are as informative as the list. Meta sends no notification when someone follows you, and none when you publish a post. Every tool works around both: follow status is checked by asking Instagram at the moment a message is about to go out, and your posts are pulled in on a schedule rather than pushed. If a tool claims to react the instant someone follows you, it is polling something, not receiving it.
What happens in the seconds after
When you comment on a post, Meta delivers a notification to the tool's server, a webhook, carrying the comment text, which post it landed on, and who wrote it. The tool then does four things in order:
- Checks the comment against your rules. Is this the post the automation is bound to? Does the text contain the keyword? Keyword matching is case-insensitive, so LINK, link, and Link all fire.
- Records the person as a contact, so the same comment doesn't trigger twice and so you have a record of who asked.
- Posts the public reply, if you wrote one. One short line in the comment thread, visible to everyone else reading it, which is the part of automation people underestimate.
- Sends the DM.
Step 4 is where Instagram's rules shape the design more than any product decision does.
When the link needs a tap, and when it doesn't
Meta permits one private reply per comment, sent within 7 days of it, and nothing in that rule limits what the reply may contain. So the usual shape is one message: the private reply arrives carrying your link on a button, and the person taps straight through to the page.
A second message is something you choose, not something Instagram imposes. Two things add one:
- An opening DM. Switch one on and the private reply becomes a greeting carrying a button; the link follows once that button is tapped. Worth spending when the greeting has real work to do, and off by default because usually it doesn't.
- A follow gate or an email gate. The gate's own ask becomes the first message, and the link waits behind whatever is being asked for.
When there is a tap, it registers as a postback, a recorded and unambiguous choice, and the link that follows arrives as a card: a title and one button that opens the page. The tap is also what lets us read whether somebody follows you, which is why a follow gate sits after it and never before.
The length you get depends on the shape you built, because the wire format changes with it. The builder enforces the right one as you type: 80 characters for a deferred card's text and 20 for its button label, 640 when the link rides on the private reply itself, and 1,000 for a reply carrying no link at all.
A deferred link is also the most common reason an automation looks broken when it isn't: if the first message landed and the link never did, a missing tap is usually the whole story. That only applies if you deferred it. We work through both cases in why isn't my Instagram DM automation working.
What the 24-hour window changes
Once someone messages you (including a story reply, or a tap on your opener), Instagram opens a messaging window of 24 hours in which you may send standard messages. After it closes, a follow-up waits until they come back on their own.
This single rule rules out a whole category of thing people expect automation to do. There is no drip sequence into a cold thread, no "day 3" follow-up, no re-engagement campaign weeks later. Automation on Instagram is fast and short by design, and the honest reframe is that speed is where the value was anyway: a reply that lands in seconds converts better than one that lands in an hour, and there is nothing to be gained by holding it.
What Instagram DM automation cannot do
Worth stating plainly, because the limits are what separate a tool built on the official API from one that isn't:
- It cannot message people who never engaged with you. No lists, no imports, no cold outreach at scale. There is no sanctioned path to it.
- It cannot send a promotional link before the person interacts. The tap is not a conversion-rate trick; it is the permission.
- It cannot follow up after 24 hours unless the person messages again.
- It cannot send more than one private reply to a single comment.
- It cannot react to a new follower, because Meta doesn't announce them. There is no follow event in Instagram's webhook list at all. We go through what that rules out, and what to do instead, in can you auto-DM new followers.
- It cannot send unlimited messages. Meta applies per-account rate limits, and a serious tool paces its sends to stay inside them. When a reel takes off and thousands of comments arrive in an hour, pacing is the difference between answering all of them and getting the account throttled.
A tool that promises any of the above is either describing something Instagram doesn't permit, or doing it outside the API, which brings us to the only check that really matters.
How to tell official automation from the risky kind
The mechanism above only exists for tools using Instagram's official API, and there is a ten-second test for whether you're looking at one:
Does it connect you through Instagram's own login screen, or does it ask you to type your Instagram password into it?
Official automation uses Instagram's login and never sees your password. A tool asking for your password is automating by impersonating you in the app, against Meta's terms, and the well-worn path to losing an account. Meta Tech Provider status tells you a company registered with Meta and passed review for the permissions it holds; it is vetting, not endorsement, so run the password test regardless of the badges on the pricing page.
For the rules themselves (what's permitted, what gets accounts in trouble), we wrote those up separately in is Instagram DM automation allowed.
And if you run more than one Instagram account, whether one automation covers all of them is its own question. The short answer is that every automation belongs to a single account.
The short version
Every automation is the same chain: engagement in, webhook, match, reply out. It starts with someone else's action, the link waits for a tap, and the conversation lives inside 24 hours. Build inside those three facts and automation feels like you answering quickly. Fight them and you're looking at a tool that shouldn't have your password.
If you want the procedure rather than the mechanism, how to send automated DMs on Instagram walks all three triggers (comment, story reply, and keyword DM) with the setup for each.