How to Turn Instagram Comments into DMs via API (Private Replies)

What a private reply is

A private reply sends a DM to the author of a specific comment, using Meta’s Private Replies mechanism. It is the API behind every “comment LINK and I’ll DM you the template” post. Three properties make it special:

• It bypasses the 24-hour messaging window — you can private-reply to a comment up to 7 days old (Meta-enforced).
• It needs no existing chat — Postproxy creates or reuses one, keyed by the comment’s author.
• Meta allows one private reply per comment, ever.

It works on Instagram and Facebook Page comments.

The comment-to-DM flow

1. You publish a post: “Comment GUIDE and I’ll send you the checklist.”
2. A follower comments “guide”.
3. Postproxy syncs the comment and fires a comment.created webhook to your endpoint.
4. Your handler matches the keyword and calls the private reply endpoint.
5. The follower gets a DM with the link.

Send a private reply

curl -X POST "https://api.postproxy.dev/api/posts/POST_ID/comments/COMMENT_ID/private_reply?profile_id=PROFILE_ID" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "text": "Here is the checklist: https://yoursite.com/checklist" }'

The response is 202 Accepted with a Message object whose chat_id points at the (new or existing) chat with the commenter. COMMENT_ID accepts the Postproxy hashid or Instagram’s native comment ID straight from the webhook payload.

The webhook handler

The comment.created event fires whenever a new comment is synced. A minimal handler:

app.post("/webhooks/postproxy", async (req, res) => {
  res.sendStatus(200); // ack fast, work after

  const event = req.body;
  if (event.type !== "comment.created") return;

  const c = event.data.object;
  if (c.platform !== "instagram") return;
  if (c.parent_external_id) return;            // top-level comments only
  if (!/\bguide\b/i.test(c.body || "")) return; // keyword match

  await fetch(
    `https://api.postproxy.dev/api/posts/${c.post_id}/comments/${c.id}/private_reply?profile_id=${PROFILE_ID}`,
    {
      method: "POST",
      headers: {
        Authorization: `Bearer ${process.env.POSTPROXY_API_KEY}`,
        "Content-Type": "application/json",
      },
      body: JSON.stringify({
        text: "Here is the checklist: https://yoursite.com/checklist",
      }),
    }
  );
});

Because Meta permits only one private reply per comment, a retry that double-fires is rejected by the platform rather than spamming the user — but dedupe on c.id anyway to keep your logs clean.

What happens after the DM lands

If the user replies to your private reply, that opens a normal conversation: their inbound message starts a fresh 24-hour messaging window, and you can continue free-form over the Direct Messages API — text, media, reactions. This is how a one-shot lead magnet becomes an actual conversation.

You can also reply to the comment publicly in parallel (“sent you a DM!”) with a regular comment reply — public proof that the automation works tends to multiply comment volume.

Rules and limits, in one place

Full endpoint details: Private reply to comment in the Direct Messages reference.