Short version: Instagram runs two separate messaging windows. The 24-hour window opens only when someone DMs you first. The Private Reply window opens when you reply to a comment by its comment ID, lasts 7 days, and works on people who do not follow you. Nearly every "my auto-DM will not send" problem is the first being used where the second was needed.
The two windows, side by side
| Standard messaging | Private Reply | |
|---|---|---|
| Opens when | Someone DMs your account | You reply to their comment |
| Addressed by | user id | comment id |
| Duration | 24 hours | 7 days |
| Works on non-followers | No | Yes |
| Live broadcasts | n/a | During the broadcast only |
Why this trips people up
The 24-hour rule is the one everyone reads about first, because it is the headline policy in most Instagram messaging guides. So when a comment-to-DM setup fails, the natural conclusion is "the window closed."
It usually did not close. It never opened. A person who commented on your reel has not sent you a DM, so there is no 24-hour window in the first place. The standard messaging endpoint has nothing to work with and returns *This message is sent outside of allowed window.*
The fix is the addressing, not the timing
The same message, addressed differently, succeeds:
POST /<ig-business-id>/messages
{ "recipient": { "comment_id": "<comment-id>" }, "message": { ... } }Because the recipient is identified by `comment_id`, Meta treats the comment as the qualifying interaction and grants a 7-day window. Per Meta's own documentation, the reply lands in the Inbox folder for followers and in Requests for non-followers.
The Live exception worth knowing
Everything above holds for posts, reels and stories with a clean 7 days. Instagram Live is the exception: the private reply must go out while the broadcast is still live. This is not a rate limit or a policy nuance, it is a hard constraint in the API, and it means Live automation has to fire in real time rather than batch afterwards.
What this means practically
If you are building this yourself, the checklist is short: address by comment id, handle the Live constraint separately, and expect non-follower replies to sit in Requests rather than Inbox. If you would rather not maintain that, AutoDM does it on the official API.