Only reply to people who asked
Trigger DMs from comments, story replies, or messages people send you first. Don't message people who didn't ask.
Is Instagram auto-DM safe? Will it get my account banned?
The honest answer, how the official API differs from password bots, what Meta's rules actually say, and how to keep your automation inside them.
Using Meta's official messaging API to reply to people who commented or messaged you first is the method Meta provides for comment-to-DM, and it is very different from bots that log in with your password or send cold DMs. No tool can promise your account will never be restricted, but what gets accounts limited is cold outreach, identical spam, and high unsolicited volume — not replying to a comment someone left on your own post.
The official API vs password and scraper bots
There are two very different ways a tool can send Instagram or Facebook DMs for you. The first is Meta's official messaging API: you connect your account by signing in through Meta (Instagram or Facebook login and OAuth), you grant specific permissions, and Meta issues an access token. Replier never asks for or stores your Instagram or Facebook password — your password stays with Meta. The second is a bot that logs in with your password or automates the app or browser like a human. Replier only uses the official API.
What Meta's messaging rules actually say
Comment-to-DM runs on Meta's private reply feature, and Meta publishes exactly how it works. A comment can get one private reply, and it must be sent within 7 days of the comment. On Instagram, a message to someone who does not follow you lands in their message requests, not their main inbox. After the person replies, you can keep messaging them inside Meta's standard 24-hour window. Staying inside these documented rules is the whole point of using the official API.
Meta: Instagram private repliesOne private reply per comment, within 7 days; non-followers receive it in message requests.
Meta: Facebook Page private repliesOne message to the person who commented, within 7 days, with a 24-hour window after they respond.
Meta: Messenger Platform policyMeta's standard 24-hour messaging window.
What actually gets accounts limited
Meta publishes API throughput limits. They are not a number that keeps an account from being restricted, and Meta publishes no number that guarantees an account won't be restricted. For an Instagram professional account, private replies to post and Reel comments are 750 calls an hour, and private replies to Live comments are 100 calls a second. The Send API allows 300 calls a second for text, links, reactions, and stickers. If the account sends and receives more than 72,000 messages, the inbox stops showing and sending new messages until that volume drops. Be wary of any tool that promises a ban-safe number. Accounts still run into trouble from behavior that looks like spam: sending cold DMs to people who never contacted you, blasting the same identical message to everyone, stuffing messages with links, or pushing unusually high volume in a short time. Replying to people who asked you a question under your own post is the opposite of that pattern.
A safe-use checklist
Make the keyword and prompt clear
Tell people exactly what to comment and what they'll get, so the people who trigger the DM actually want it.
Send a useful, relevant reply
Deliver the resource they asked for. Avoid unrelated pitches and long automated sequences.
Vary your public replies
Save a few public replies. Replier uses one of them each time, in order or at random (your choice), instead of posting the identical comment every time.
Don't stuff every message with links
Keep one clear primary link or button. A wall of links reads as spam.
Ramp up, don't blast
Meta's documented rate limits are API throughput, not a ban-safe daily number. Grow volume gradually and watch how your account responds.
What Replier does by design
Only replies to people who engaged first
Replier answers comments, story replies, and incoming DMs. It never sends cold outreach to people who didn't contact you.
Uses Meta's official API
Accounts connect through Meta's login and OAuth. Replier never asks for or stores your Instagram or Facebook password.
One private reply per comment
Replier sends a single private reply per comment, as Meta's rule requires. If another tool already sent the private reply, Meta refuses a second one and Replier marks the comment as already replied.
Several public replies
Save several public replies and Replier uses one of them each time, in order or at random (your choice), so the same text isn't posted on every match.
You stay in control
You pick the posts, keyword, public reply, and DM, and can pause or disconnect at any time. Replier posts the public replies you turn on, and sends the DM you wrote.
So, is it safe?
Using the official API to answer people who contacted you first is the method Meta provides for this workflow, and it avoids the password-bot and cold-DM behavior that puts accounts at risk. That is lower risk than unofficial bots, but no tool — including Replier — can rule out a Meta restriction entirely, because delivery always depends on Meta's permissions and policies. Keep your automations to messages people reasonably asked for.
FAQ
There's no guarantee either way, but replying to people who commented or messaged you first through Meta's official API is the method Meta provides for comment-to-DM, and it's very different from password bots or cold DMs. Accounts usually run into trouble from spam-like behavior — cold outreach, identical mass messages, and unusually high volume — not from answering a comment on your own post.
No. You connect by signing in through Meta (Instagram or Facebook login and OAuth) and granting permissions. Replier never asks for or stores your Instagram or Facebook password — it stays with Meta.
The private-reply pages linked on this page don't describe a shadowban or a reach penalty for private replies. Meta's rate limits, linked above, are API throughput, not a number that guarantees your reach. The safest approach is to only message people who engaged first, keep messages relevant, vary your public replies, and avoid link-stuffing and sudden high volume.
Any comment-to-DM tool that connects through Meta's official API and only messages people who contacted you first follows the same Meta rules Replier does. The risk comes from how a tool is used — cold DMs and spam — more than from which official tool sends the reply. Avoid any tool that asks for your Instagram password or automates the app instead of using Meta's API.
Meta's rate-limiting page documents API throughput, not a ban-safe number, and Meta publishes no number that guarantees an account won't be restricted. For an Instagram professional account, private replies to post and Reel comments are 750 calls an hour, Live comments are 100 calls a second, and the Send API allows 300 calls a second for text, links, reactions, and stickers. A comment can still get only one private reply within 7 days, and after someone replies you can message them inside Meta's 24-hour window. Be wary of any tool that promises a ban-safe number.
No, and you should distrust any tool that does. Replier uses the official API and only replies to people who engaged first, which is lower risk than unofficial bots, but delivery always depends on Meta's permissions and policies.