Comment to DM

Self-hosted Instagram comment-to-DM automation. One Cloudflare Worker and one D1 database on your own account, on the free plan.

Docs · Quick start · Contributing

What it does

Your reel says "comment GUIDE for the link". Someone comments guide, and about two seconds later your link is in their DMs, sent from your account, with an optional public reply under the comment. You set it up as keyword rules in an admin panel on your Worker.

• Rules cover one post or all of them, and match whole words or anywhere in the comment, for hashtags like #launch2026.
• Exclusions per rule, so "how much is the guide?" doesn't use up that comment's one DM.
• Reply to every comment on one post, no keyword needed, for giveaways and waitlists.
• {username} in the DM or public reply, and several public replies picked at random so the thread doesn't look automated.
• Any script works. Case, emoji, punctuation and Latin accents are ignored: preco matches PREÇO.
• Eight templates (free guide, price list, giveaway entry and five more) fill in a rule's keywords, DM and public replies. A template won't save until your own link replaces its placeholder.
• Several Instagram accounts per deployment, and an admin panel you can install on your phone.

How it's done today

Hosted tools charge $15 to $99 a month. They hold an access token to your Instagram account on their servers next to every other customer's, your followers' messages pass through them, and the automation lasts as long as the company does. The alternative is replying by hand, which stops working the day a reel takes off.

What's different

The same automation runs in your Cloudflare account instead, on Meta's official Instagram API through Instagram Login. There's no scraping and no browser automation, and the Worker never sees your password.

someone comments "guide"
          │
          ▼
Meta webhook (signed) ───▶ your Worker ◀─── poll every 5 minutes
                                │
                 claim the comment in D1, match your rules
                                │
                                ▼
       one private DM, now or from the queue (12 a minute)
                                │
                                ▼
                    an optional public reply

There are two ways in because Instagram silently drops webhooks for collapsed and low-signal comments. Every five minutes the Worker reads the last 72 hours of comments on up to 3 posts per account, taking turns when rules cover more, and answers up to 10 per run that the webhook missed. Both paths claim the comment with INSERT … ON CONFLICT DO NOTHING before sending, so a duplicate delivery can't produce a second DM. Each DM call gets one attempt: one whose answer is lost is logged as "may have been delivered" and sent again only if you press Send again after checking. A DM Instagram turns down for now (rate limits, its own temporary errors) is tried again after 1, 5 and 20 minutes.

The Worker is about 7,000 lines of TypeScript, with one runtime dependency (hono) and no client-side JavaScript. Instagram tokens are encrypted with AES-256-GCM under a key that exists only in your Cloudflare account.

Who it's for

Creators and small businesses who run "comment X for the link" posts and would rather not pay $180 to $1,188 a year, or give a third party a token to their account. Setup is five terminal commands and a screen-by-screen guide through Meta's dashboard.

What can go wrong

• Professional accounts only. Instagram's API doesn't work with personal accounts. Switching to Creator or Business takes a minute in the app.
• Your Meta app has to be Live. In Development mode Meta sends no real comment webhooks, so only the five-minute poll works. Publishing needs no App Review while only your own accounts connect as Instagram Testers. Letting strangers connect theirs would need App Review; this is built for one person and their own accounts.
• One private reply per comment, ever, within 7 days. No follow-up unless they reply to you. Older comments are skipped.
• About 750 private replies per hour per account, Meta's cap. The Worker sends at most 12 a minute per account, which keeps every hour under it, and queues the rest, sending the oldest first every minute. One cron run a minute sends for every account, so a backlog of 5,000 on one account takes about 7 hours, and two accounts with backlogs get about 7 a minute each. A comment still queued an hour before Instagram's 7-day limit is skipped.
• Meta changes things. It renames dashboard screens, retires OAuth hosts and changes which secret signs webhooks. The code pins Graph API v23.0, which Meta will eventually retire.
• Blind spots. Comments hidden by Instagram's Hidden Words filter never reach the API. DMs to non-followers land in Message requests. For a rule on all posts, the poll reads only your 3 newest, so comments on older posts rely on the webhook alone.
• 60-day tokens. A nightly job refreshes them. If it stops, /health turns 503 before they expire; a lapsed account needs a 20-second reconnect.

What it costs

$0. Meta doesn't charge for the API, and it fits Cloudflare's free plan:

This is the beginning of the README. Read the rest at the original. Read the full README ↗