Instagram Private Reply API — Why Your Auto-DM Fails for Non-Followers (2026 Fix)

If you've built an Instagram auto-DM bot in 2026 and your sends silently fail for users who don't follow you, you've hit the most common bug in the space. Meta returns:

{
  "error": {
    "message": "This message is sent outside of allowed window.",
    "type": "OAuthException",
    "code": 10
  }
}

The fix is one endpoint switch. It's been live since Meta opened the path for "comment → DM" automation in 2024, and the documentation is buried two clicks deep.

The standard messaging endpoint is the wrong endpoint

Most tutorials show this:

POST /me/messages?access_token=...
{
  "recipient": { "id": "<recipient_igsid>" },
  "message":   { "text": "Hey, here's your link!" },
  "messaging_type": "RESPONSE"
}

This works only inside an active 24-hour conversation window. Non-followers who comment on your post haven't started a conversation with you, so Meta blocks the DM.

Private Reply: address by comment_id, not user_id

POST /<your-ig-business-id>/messages?access_token=...
{
  "recipient": { "comment_id": "<the_comment_id>" },
  "message":   { "text": "Hey, here's your link!" }
}

Two changes from the broken version:

1. `recipient` keys on `comment_id`, not `id` — Meta uses the comment as the messaging anchor.
2. No `messaging_type` — Meta infers MESSAGE_TAG from the recipient shape.

This grants a 7-day window from the comment timestamp. Works for followers and non-followers identically.

The webhook side

To get comment_id in the first place, subscribe to the comments field on your IG business account:

curl -X POST "https://graph.facebook.com/v22.0/<ig-business-id>/subscribed_apps?\
  subscribed_fields=comments&access_token=<token>"

Then in your webhook handler:

const v = entry.changes[0].value;
const commentId  = v.id;          // ← the Private Reply key
const fromIgsid  = v.from.id;     // ← for follower checks, not DMs
const text       = v.text;        // match against your keyword rules

The public comment reply

While you're DM'ing, also post a public reply on the same comment. This serves two purposes: viewers see the bot worked, and others are more likely to copy the behavior.

POST /<comment-id>/replies?access_token=...
{ "message": "Sent ✓ check your DMs @user" }

Public replies are not subject to either messaging window — they're regular comment activity governed by spam policy.

What StackPicks AutoDM does differently

When we hit this bug ourselves on June 5, 2026 — demo_fluenco getting "outside allowed window" while piyush.jangir (who follows us) succeeded — we ripped out the standard messaging path and rebuilt the engine around Private Reply. The result: 100% delivery rate to non-followers within the 7-day window, regardless of follower count.

Our follow-up agent then uses standard messaging for AI-generated replies that arrive after the recipient has DM'd back — at that point the 24-hour conversation window is open, and standard messaging is the right tool.

Quick checklist before shipping

1. Switch your DM send to recipient: { comment_id }.
2. Remove messaging_type from the payload.
3. Verify your webhook captures value.id as comment_id.
4. Test with a non-follower account and watch your dm_log.

That's the whole fix.

— Piyush