Instagram Comment-to-DM Automation with the Official API

Create a Business type app at developers.facebook.com, then add the Instagram API with Instagram Login product. You do not need a Facebook Page.

Request these four scopes together, up front:

• instagram_business_basic
• instagram_business_manage_messages
• instagram_business_manage_comments
• instagram_business_manage_insights (for stats later; adding scopes later means re-authenticating)

Register your redirect URIs exactly, including /api/instagram/callback. Scheme, host, and path must match character for character.

Only tester accounts trigger anything before App Review, so add your own account under Roles, Instagram Testers. Two requirements:

1. It must be a Business or Creator account. Convert it in the Instagram app under Settings, Account type and tools.
2. Accept the invite inside the Instagram app, under Settings, Apps and Websites, Tester Invites. There is no notification. It waits there until you tap accept.

Meta sends zero webhooks in dev mode. Switch the app to Live. With Standard Access this exposes nothing to the public; data still flows only for testers. It just turns webhooks on. The dashboard Test button only sends sample payloads, so a green test proves reachability, not working logic.

Subscribe to comments and messages on the Instagram object, and verify the callback URL. Note: tunnel URLs rotate, and each rotation invalidates the callback. If webhooks stop after a restart, re-verify first.

The flow: Meta posts a signed payload to your webhook endpoint, you verify the signature, match the comment against your keyword rules, then call the API twice (public reply, private DM). I run this on my own server (Astro endpoints plus Postgres for tokens, posts, rules, and processed comment IDs). A Cloudflare Worker with any small store works the same way.

What the docs do not spell out:

• Token exchange has three hops: code to short-lived token to 60-day long-lived token. Store it encrypted, track expiry, refresh on schedule. An expired token fails with errors that look like scope problems.
• The dashboard tick is not enough. Each account must also grant the subscription via the subscribed_apps edge after OAuth, or no events arrive.
• Verify then parse. Check the X-Hub-Signature-256 HMAC against your App Secret before parsing.
• Dedupe by comment ID. Meta retries deliveries. Record each processed comment ID and skip repeats, or a retry becomes a duplicate public reply.
• Match through the synced post. Webhook IDs and token IDs live in different namespaces, so join on the comment’s media ID against your synced posts instead.
• Policy is code, not copy. One DM per comment within 7 days, one follow-up within 24 hours. Enforce it in the send path, and include a human contact line plus opt-out in every message.

Expose your local server (I used cloudflared), re-verify the callback URL against the tunnel address, then comment from your tester account on a synced post.

Healthy logs always look the same: request line, payload, sends complete. In that order.

The rule that would have saved me days: no log lines at all means the request never reached your server. That is a routing problem, not a code bug. Confirm with a signed test post to your own webhook URL. If your own test logs but real comments do not, the fault is Meta-side (dev mode, tester status, subscription, rotated tunnel). If even your own test logs nothing, the fault is routing.

Comment keywords from a second tester account and check:

• Contains vs exact. GUIDE fires; GUIDANCE must not fire in exact mode.
• Non-followers. The DM still sends but often lands in Message Requests. Tell users to check Requests.
• Dedupe. Replaying a comment ID sends nothing new; two fresh comments send once each.
• Token failures. Expired token refreshes and retries; revoked permission shows a reconnect prompt.

For follow-ups, use CTA buttons via generic templates rather than pasted URLs. Standard Access covers your own account; a public rollout needs App Review for Advanced Access (paperwork, not code, and no Tech Provider status needed for your own account).