Every few weeks someone asks us for a feature that cannot be built. Not "we have not built it yet". Cannot be built, by anyone, without breaking your account.
The reason the question keeps coming is that other tools advertise these features. So rather than argue, here is each one checked against Meta's published documentation, with what a tool is actually doing if it offers you the feature anyway.
Can you auto-DM every new follower?
No. This is the most requested one by a wide margin, and it fails at the first step: your software is never told that the follow happened.
Instagram's webhooks are the only way an app finds out that something occurred on your account. Here is the complete list of fields Meta publishes:
comments, live_comments, mentions, message_echoes, message_reactions, messages, messaging_handover, messaging_optins, messaging_policy_enforcement, messaging_postbacks, messaging_referral, messaging_seen, response_feedback, standby, story_insights
There is no follower event. Not a restricted one, not a permission you can apply for. It is not in the list.
There is also no endpoint that returns who follows you. The API gives you a follower count, which is a number, not a list of people you could message.
And even if both of those existed, the third barrier would still stand, which is the next section.
Can you send a DM to someone who has not messaged you?
No, and this is the load-bearing rule underneath all of it. Meta's messaging documentation states it plainly:
Conversations only begin when an Instagram user sends a message to your app user through your app user's Instagram Feed, posts, story mentions, and other channels.
The customer starts the conversation. Always. Your business can reply, and reply well, and reply in under a second, but it cannot go first.
There is exactly one apparent exception and it is narrower than it looks: a private reply to a comment. Someone comments on your post, and you may send them one DM about it. That is not you initiating, it is Meta treating the comment as the opening. It is capped at one private reply per comment, ever, so you cannot loop it into a broadcast.
This single rule is why comment-to-DM became the entire industry. It is not a growth hack somebody discovered. It is the only door.
Can you mass-DM your followers or an audience list?
No. It follows directly from the above. There is no broadcast endpoint on Instagram messaging, no audience upload, no segment-and-send. Each conversation must have been opened by that person.
If you want a channel where you can message a list, that is WhatsApp, which has an explicit opt-in and template system for exactly this purpose, and charges you per conversation for the privilege. Instagram messaging is free precisely because it is reactive.
Can you auto-follow, auto-like or auto-comment?
No. There are no API endpoints for following an account, liking a post, or leaving a comment on someone else's media as your business.
This is the category where the risk is highest, because these tools do exist and they work, for a while. They work by logging into your account in a hidden browser and clicking, which is indistinguishable from a bot to Instagram's systems, because it is one. The usual outcome is a temporary action block, and the eventual outcome is worse.
The distinction worth holding onto: automation is not the problem, unofficial access is. An official-API tool is subject to Meta's rate limits and terms and cannot get you banned for using it as designed. A browser-driving tool is pretending to be you.
The one that is real but harder than advertised
The human agent tag. Meta's documentation says you can tag a reply as coming from a human agent to answer outside the standard 24-hour window, which extends it to seven days.
What the documentation does not say, and we found out by trying it on a live account, is that using it returns a 403 with a message saying the capability must be reviewed and approved by Facebook first. It is not on by default. So if a tool advertises a seven-day reply window as a feature, the honest version is "seven days once Meta approves your app, twenty-four hours until then".
We are in that queue ourselves. Until it clears, our own window is twenty-four hours and we say so.
What you actually can do
Everything on this list is officially supported, and honestly it is most of what a creator needs:
- Reply publicly to a comment and send that person a DM, triggered by a keyword or by any comment at all
- Reply automatically to a DM, on a keyword or on the first message of a thread
- Reply to a story reply, and to a story mention, as separate triggers with separate intent
- Send buttons, both quick replies and real tappable link buttons carrying a URL
- Set ice breakers, up to four suggested questions shown when someone opens an empty thread with you on mobile
- Use ig.me referral links, which carry a code telling you where the person came from
- Read your own media and its insights, which is what makes post-level attribution possible
Within the 24-hour window you can send free-form messages with no per-message charge. Instagram messaging has no conversation pricing, unlike WhatsApp.
Each of those seven carries a rate limit or a window, and every one of those numbers is sourced from Meta here. Point 7 is the one most people leave switched off: reading your own media insights is what makes knowing which post actually brought the leads possible at all.
How to check any tool's claims yourself
Two questions, and you do not need to be technical to ask them.
"Which official permissions does your app hold?" The Instagram permissions are named things: instagram_business_basic, instagram_business_manage_messages, instagram_business_manage_comments. A tool operating legitimately can name them. A tool driving a browser will change the subject.
"Do I log in with Instagram's own screen, or do I give you my password?" Official access uses Instagram's OAuth page and never sees your password. If a tool asks for your password directly, that is the browser-automation model, whatever else the site says.
The short version
Auto-DM every follower, mass-DM your audience, auto-follow and auto-like are not features anyone is missing. They are not in the API, and the tools that offer them are logging into your account and clicking.
What is left is narrower and works reliably: someone engages with you first, and everything after that can be instant.
Kredoo does the seven things on that list and none of the four above them. If that trade sounds right, start free: 200 DMs a month, no card. The plans for creators have the rest.
Questions people ask
Can any tool auto-DM new Instagram followers?
No. Instagram publishes no webhook for a new follower, so no app is ever notified that the follow happened, and there is no endpoint returning your follower list. Separately, Meta's documentation states that conversations only begin when the user messages you first, so even with a list the message could not be sent.
Can a business send the first Instagram DM to a customer?
No. Meta's messaging documentation states that conversations only begin when an Instagram user messages your account. The only near-exception is a private reply to a comment, which is limited to one reply per comment.
Is Instagram automation safe, or will it get my account banned?
Automation built on the official Instagram API is safe by design, because it operates within Meta's terms and rate limits. The bans come from tools that drive a logged-in browser session to follow, like, comment or mass-DM, since those actions have no API and can only be performed by imitating you.
What is the Instagram human agent tag and can I use it?
It is a tag that extends the reply window from 24 hours to 7 days for human-answered conversations. Meta's docs describe it without mentioning approval, but in practice using it returns a 403 saying the capability must be reviewed and approved first, so it is not available by default.
How do I check whether an Instagram tool uses the official API?
Ask which permissions the app holds, since legitimate tools can name them, for example instagram_business_basic and instagram_business_manage_messages. Then check whether you sign in on Instagram's own login screen or hand the tool your password. A tool that wants your password is not using the official API.
Does Instagram charge per message like WhatsApp?
No. Instagram messaging has no per-conversation pricing. Free-form replies within the 24-hour window carry no Meta charge, which is one reason the channel is reactive rather than broadcast.
Stop losing leads to the follow-up gap
Kredoo captures leads from Meta and Google Ads, then follows up on WhatsApp automatically. Live in 5 minutes.
Get Started