Instagram automation, without the part where your account gets restricted

Four different things get called Instagram automation and only one of them is something a platform-approved tool can do. This page separates them, explains the two clocks everything runs on, and walks one build from the trigger word to the screen that tells you why a reply did not send.

Somebody types price under your Reel at eleven at night. You see it at nine the next morning, along with forty others. That gap is the entire market for Instagram automation, and it is also where most of the bad advice about it lives.

The word covers four unrelated activities. Only one of them is something a platform-approved tool can do at all, and separating them is the first useful thing anyone can tell you.

The four things people mean by this

  1. Replying to your own comments and DMs. Somebody engages with your account, a rule reads what they wrote, and a reply goes out. This runs on the official Instagram Graph API with a token you authorise through Meta. This is the one we do.
  2. Publishing. Scheduling posts and Reels. There is a real API for it and there are real products built on it. We are not one of them — we answer people, we do not publish.
  3. Engagement farming. Auto-follow, auto-unfollow, auto-like, auto-comment on strangers' posts. There is no API for any of it. Every tool offering it needs your password or your session, and drives the app while pretending to be you.
  4. Cold outreach at volume. DMing people who never contacted you. The messaging API does not permit it, so tools that do it are back in category three.

Categories one and two are boring, permitted and auditable. Categories three and four are the ones people are thinking of when they ask whether automation is safe.

Everything runs on two clocks

This is the part almost nobody explains before selling you something, and it explains most of what looks like a broken setup.

Two timelines side by side: a seven-day window running from a comment, and a twenty-four hour window running from a person's last message.
The two clocks start at different events. The comment clock starts when they comment. The DM clock starts when they message you, and every new message from them restarts it.

A comment reply lives inside a 7-day window from the comment itself. After that the API will not accept a reply to that comment, and no tool can change it.

A direct message lives inside a 24-hour window measured from that person's last message to you. Not from your last message. Not from when they followed you. Their message starts the clock, and their next one restarts it. This is why a "nurture sequence" that drips messages over five days is not a thing a compliant Instagram tool can offer: on day two the window is shut.

On a post you published this morning, neither clock is a problem. On a post from a fortnight ago, one of them is, and the symptom is silence rather than an error.

What actually puts an account at risk

Not the existence of a rule. Four specific behaviours, and all four are things a tool can either do or refuse to do on your behalf:

  • Messaging people who never messaged you.
  • Sending the same string to everyone, forever, so the account reads as a vending machine.
  • Hammering a retry when the platform said no, rather than recording the refusal and stopping.
  • Volume with no upper bound, on an account with no history of that volume.

A tool built on the Graph API cannot do the first one at all. The other three are design decisions, and the way you check whether a tool made them is to ask what it does when a send is refused. If the answer is a red dot and nothing else, that is not a safety story.

The ten checks, in their fixed order

Every outbound reply passes through the same gate before anything is drafted. The order is fixed and the first check to fail stops the send.

Ten gate checks in a fixed sequence, each one able to stop an outbound reply and record its reason.
First failure wins. That is why a refusal has one reason attached to it rather than a list of them.

kill_switch, connection, takeover, window, dedupe, cooldown, quiet_hours, rate_budget, credits, content_safety.

Three of those are worth reading twice.

takeover stands the automation down in a thread the moment you reply by hand. It is a gate check rather than a setting, which means you cannot accidentally leave it off, and it is the thing that stops a customer receiving a template thirty seconds after you personally answered them.

dedupe exists because Instagram redelivers events. The same comment can arrive twice. Without a dedupe key, that is two replies to one person.

window is the two clocks above, enforced rather than hoped about.

Every refusal is written into Activity with the name of the check that stopped it and a sentence saying what would change it. A blocked list is not a bug list — most of it is the platform's rules working correctly, and reading it once a week is how you find the one entry that is actually your fault.

Building one, end to end

The builder asks for the same things in the same order every time.

  1. The trigger. Which post, and which words. Keywords are any-of, where one match fires the rule, or all-of, where every listed word must appear. Any-of is right nearly always.
  2. Negative keywords. The words that mean do not reply. not interested is the one everyone needs and nobody thinks of on the first pass.
  3. The public reply. A short line under the post. It is a receipt, not the answer — it tells that person to check their DMs and tells the next hundred scrollers that commenting gets a response. "DM kar diya 📩" beats a paragraph.
  4. The private reply. The actual answer, in the inbox, subject to the 24-hour clock.
  5. Capture to Leads. Leave it on. Somebody who asked a question is worth having on a list even when the reply was unremarkable.
  6. Advanced. First-time senders only, quiet hours, and scoping to specific posts. Scope to specific posts unless you genuinely mean the whole account.

Keyword matching ignores case and punctuation, so PRICE? and price are the same string to the matcher. What it does not do is guess. It does not know that pricing is a form of price, and it will not infer that "how much??" is a price question. If you want those matched, you list them.

The trigger word also has to exist somewhere a human will read it. "Comment SIZE and I will send the chart" is the highest-leverage sentence in the whole setup and it lives in your caption, not in the builder.

Two buttons, and the panel beside them

Try It lets you type a message yourself — pretend somebody wrote this — and shows whether the rule would fire, which keyword matched, and exactly what would go out. Nothing is sent and nothing is recorded. It does not replay comments you already received; it tests the rule, not the past.

Test on myself runs the whole pipeline for real — match, all ten checks, generation, send — and delivers the result to your own account. Read it for tone rather than correctness. Correctness you can check by rereading your template. Whether it sounds like the person who runs this account is something you can only judge by receiving it.

Then Go live, on one post. Not the account. One post, for a few days, until its blocked list looks boring.

A rule you can describe in one sentence is a rule you can debug at nine on a Monday morning.

What this does not do

We reply to people. We do not create posts. There is no caption generator, no hashtag tool, no content calendar, no scheduling or publishing, no follower growth feature and no analytics product. There is no WhatsApp, Messenger or Telegram. There is no flow-builder canvas, no broadcast and no multi-step nurture sequence — the last of those is the 24-hour window again, not a missing feature. Leads leave as CSV; there are no one-click CRM integrations.

If that list rules us out, it is better to know now than after connecting an account. The roadmap says which of them are decisions rather than gaps.

What it costs, in shape rather than in numbers

A templated reply — one you wrote yourself — is free and unlimited. A credit is spent only when the AI writes something new for a specific message, and that is one credit for one reply. Nothing is metered per contact, per follower or per conversation, so a post that does unusually well does not produce a larger invoice.

The free tier is 100 credits and no card. Credit packs are ₹499 for 500 credits, ₹1,699 for 2,000 and ₹4,499 for 6,000, or $6.99, $22.99 and $59.99. The credits page is the exact accounting of what spends one.

Where to go from here

If you are building a comment rule today, the comment automation guide is this page's build section at full depth. If the DM side is what you need, the 24-hour clock behaves differently enough to deserve its own guide. And if you want to know what changes when the model writes the reply instead of you, that is here.

For the argument rather than the instructions, the honest version of the safety question and what ban risk actually is are the two worth your time. If you are choosing between tools, the comparisons name who each one is genuinely better for.

Questions people ask

Is Instagram automation allowed?
Replying to comments and messages on an account you own is allowed, through the official Instagram Graph API, with a token you authorise through Meta. Automating follows, likes and comments on other people's posts is a different activity, it needs your password rather than a token, and no approved API offers it.
Will automation get my Instagram account banned?
What puts accounts at risk is the method, not the word. A tool holding your password and driving the app is acting as you, at machine speed, outside anything Meta sanctions. A tool on the Graph API sends requests Meta receives, logs and rate-limits, and the worst normal outcome is a refused send you can read the reason for.
Why did my automation not reply to a comment?
Open Activity and filter to blocked. Ten checks run before any reply is drafted and the first one to fail is written against the run by name. The two most common are the seven-day comment window having closed on an older post, and a duplicate event Instagram redelivered, and neither is a fault.
Do I need a Business account to automate Instagram?
You need an Instagram professional account, which means Business or Creator, connected to a Facebook Page. That is Meta's requirement rather than ours and it is the single most common reason a first setup stalls before it starts. A personal account cannot be connected at all.

Updated