Instagram Direct AI Chatbot: API Limits and Meta Rules Explained

Instagram Direct AI Chatbot: API Limits and Meta Rules Explained

You can handle Instagram Direct with AI through Meta's messaging API, as long as the account is a professional account, the app has approved permissions, and the agent replies inside the conversation window the customer opened. The AI can triage, answer questions and collect details. It cannot start a cold conversation or act outside the window and transparency rules. To avoid losing context, keep Instagram and WhatsApp in a single history per customer, with a clear handoff to a person. Those are the practical Instagram Direct AI chatbot API limits to plan around.

Key takeaways

• The Instagram messaging API requires a professional account, an app registered with Meta, approved permissions and webhooks to receive messages.
• The customer starts the conversation. The business replies within a time window, and after it closes only a person, in specific permitted cases, can pick the thread back up.
• AI automation is accepted when there is transparency, a path to a human and compliance with platform policies, which change and should be checked in the current documentation.
• Unifying with WhatsApp means one contact record with several channel identities, not merging conversations on a guess.
• Start the pilot with one narrow flow, a decision log, a cap on agent actions and one person responsible for the handoff queue.

What the Instagram messaging API allows

AI support on Instagram does not happen inside the Instagram app. It works because an app registered with Meta receives your business account's messages through a webhook, processes them and sends the reply back through the API. The official documentation lives on Meta's developer portal, and it is the reference that should win over any summary, including this one.

In general terms, the API offers the following:

• Receiving direct messages that customers send to the professional account, including text and media, via webhook.
• Sending replies in text and, depending on the formats supported at the time, media and quick-reply elements.
• Reading basic profile data about the sender, such as the user identifier scoped to your app.
• Replying privately to a comment, under limited conditions, to move the conversation from public to Direct.
• Working with more than one app on the same inbox, with rules about which one controls the conversation at a given moment.

To use this in production you normally need a professional account (business or creator), a Meta app, the messaging permissions, the app review process for access beyond test mode and, in some cases, business verification. The exact path (for example, linking through a Facebook Page or using Instagram login directly) has changed over time. Before you commit to a timeline, confirm the current flow in the documentation.

One practical consequence: app review asks you to explain what each permission will be used for. If the stated purpose is support and triage, the agent should not do anything else in production.

What are the reply window and automation rules?

This is the point that surprises people coming from WhatsApp. Instagram has no concept of an approved template that lets you contact a customer whenever you want. The logic is reply-based: the customer writes, which opens a window, and the business answers inside it.

According to Meta's documentation, the standard reply window is 24 hours from the customer's last message. A human agent tag extends that period up to 7 days, but it is meant for replies written by a person, not by an automated flow. Confirm those periods and the conditions for using the tag in the current documentation, because Meta can change them.

What this means for how you design the service:

• The AI agent replies while the window is open, quickly and within the agreed scope.
• If the conversation needs analysis that will run past the deadline (a quote, an internal check), the agent tells the customer what will happen next and logs the pending item for a person.
• Once the window closes, the agent cannot nudge the customer on its own. Follow-up depends on the customer writing again or on the team using a permitted human path.
• Mass outbound prospecting through Direct is not what the support API is for. For notices and reminders sent with permission, WhatsApp is usually the better channel, using templates and well-collected opt-in.

On automation itself, platform policies broadly ask for transparency with the user and a way to reach a person. There are also restrictions on how message data can be used. In practice, adopt three internal rules even where the policy does not spell them out case by case: the agent introduces itself as an automated assistant, the customer can ask for a human at any time, and nothing the customer writes is used for any purpose other than the support itself.

How do you unify Instagram and WhatsApp without losing history?

The common mistake is treating each channel as a separate system, with its own agent, its own notes and its own repeated questions. Customers notice. They ask on Instagram, then message on WhatsApp and have to explain everything again.

The fix is not an integration trick. It is a simple data model:

• Contact: the person, with name, notes and recorded consents.
• Channel identity: the Instagram identifier (valid within your app's scope) and the WhatsApp number, each linked to the contact.
• Conversation: one exchange on one channel, with a start, an end and a status.
• Message: text or media, with channel, time and author (customer, AI agent or team member).
• Decision: what the agent did and why, such as looking up a record, opening a task or handing off.

The delicate part is joining identities. Instagram does not give you the customer's phone number. So the link between Direct and WhatsApp should only happen when the customer provides their own number or email, preferably with a simple confirmation. Merging two profiles because the names look similar is a good way to expose one person's data to another, and that is a serious privacy problem.

On the technical side, your own integration layer (a lightweight backend or a workflow tool such as n8n) receives webhooks from both channels, normalizes the messages into one format and writes everything to the same database or CRM. For WhatsApp, the guide to an n8n WhatsApp Cloud API support flow gives a useful reference, and the article on how to integrate AI into your company's WhatsApp covers the decisions on the other side.

If the company uses a model hosted outside Brazil, also read about international data transfer under LGPD when using AI providers, since Direct messages often contain the customer's name, profile photo and other personal data. As a starting point on your obligations, the official source is Brazil's data protection authority, the ANPD.

Step-by-step: putting Direct into operation

Below is a sequence that tends to work without surprises. The order matters: the first steps prevent wasted work in the last ones.

• Map the real questions. Sort incoming Direct messages by type: product question, price, availability, after-sales, complaint, partnership. Pick one type that is frequent and low risk.
• Define what the agent never does. Examples: promise a delivery date without checking the schedule, negotiate a discount, handle a complaint that includes a legal threat, give technical advice without review.
• Confirm the Meta requirements. Professional account, app, permissions, review and business verification. Request access with the exact description of how you will use it.
• Build message intake. A webhook with signature verification, a queue so events are not lost and handling for duplicate messages.
• Write the agent's instructions with a short scope: tone, limits, when to hand off and what to tell the customer when it does not know. The article on how to write instructions for an AI support agent can serve as a base.
• Protect against manipulation. Customer messages are untrusted input. Give the agent only the tools it needs, and see the prompt injection protection guide for practical measures.
• Build the handoff. Define who receives it, in which tool, with what summary, and what the agent says while the customer waits. Inside the window, the person replies on the same channel.
• Log everything. Every reply with the decision that produced it, for auditing and for tuning the instructions.
• Run a short pilot with a few question types, set hours and one person reviewing the conversations every day.
• Decide: expand, adjust or stop, based on the metric you agreed on before starting.

For agent observability (what it received, which tool it called, how long it took), the OpenTelemetry primer on observability helps standardize logs and traces without depending on a specific vendor.

In our method, these steps group into four moves: map the process and the starting point, limit the agent's data and actions, pilot one real flow with logging and an agreed metric, and hand over to the team with a decision to expand, adjust or end. No step depends on promising a result before measuring.

Illustrative scenario: a clothing store with Direct and WhatsApp

This is an illustrative scenario, unrelated to any real company. A clothing store gets questions on Direct about sizing, availability and exchange deadlines, and the sale is then closed on WhatsApp.

A customer asks on Instagram whether a certain coat is still available in her size. The agent introduces itself as an automated assistant, checks stock through a read-only tool and replies. She says she wants to buy and asks about delivery. The agent explains that a team member closes the sale and asks, if she is happy to, for her WhatsApp number to continue there. She provides it, the agent records her consent to be contacted about that order and creates a task with a summary: product, size, city and what has already been answered.

The team member opens the task and sees the Direct history attached to the contact. She continues on WhatsApp without asking again what was already said. Had the customer gone quiet for longer than the Direct window, the agent would have had no way to pick the topic back up there. Contact would continue only on WhatsApp, with the permission already given.

In this design, the agent never changes stock, never grants a discount and never merges profiles on its own. It looks things up, replies, logs and hands off.

Frequently asked questions

Can I use a third-party chatbot instead of building the integration? Yes, and at the start it is usually faster. Check whether the vendor uses Meta's official API, how it stores history, whether you can export your data and how the human handoff works. If the history stays locked inside the tool, unifying with WhatsApp becomes hard later.

Can the agent start a conversation with someone who commented on a post? Under limited conditions, the API allows a private reply to a comment, but it is not a free outbound channel. The rules on timing and volume change, so confirm them in the current documentation before building a campaign on top of it. For recurring notices, WhatsApp with recorded permission is the more suitable path.

Do I need to tell the customer they are talking to an AI? Yes. It is the recommended practice and, broadly, matches what the platform and LGPD expect in terms of transparency. A short sentence at the start of the conversation and the option to call a person are enough. If the agent makes decisions that affect the customer, read about automated decisions and the right to review.

What should I do when the reply window expires and the case is still open? Do not try to work around it with automation. Log the pending item, make clear to the customer what will be done while the conversation is open and, if you have a WhatsApp number with permission, continue there. If you do not, picking it back up depends on the customer replying or on a human path that Meta permits in its current documentation.

Sources

• Meta for Developers: Instagram Platform (mensagens, permissões e políticas)
• ANPD: Autoridade Nacional de Proteção de Dados
• OWASP: prompt injection prevention
• OpenTelemetry: observability concepts