How to Set Up Instagram Comment-to-DM Automation in 2026: Dashboard, API, and MCP

TLDR: Comment-to-DM automation turns “comment GUIDE and I’ll send it” into a rule. Meta’s private reply feature lets a business send one DM to a commenter, within seven days, without the person messaging first; a webhook tells your tool the comment happened, the tool matches keywords, and the DM goes out. In PostZen you set one up from the dashboard, from one API request, or by asking an AI agent through MCP. Choose word matching with typo tolerance for most campaigns, scope the automation to a post or leave it account-wide, add up to three link buttons or an image card, use the follow gate when the link is the reward for following, and read the log to see who got what. Pricing is per connected account with no contact metering. Facts checked against Meta’s documentation and PostZen’s docs on September 18, 2026.

What is comment-to-DM automation?

You post a Reel and write “comment GUIDE and I’ll DM you the link.” Someone types GUIDE. Within a minute they have a direct message with a button that opens the link, and under their comment there is a public reply saying “sent!” so the next person knows it works. You did none of it by hand.

That is comment-to-DM automation, and it works because of one Meta feature: the private reply. A business or creator account can reply to a comment with a direct message, once, without the commenter having messaged the account first. Everything else, the keyword matching, the delay, the buttons, the public reply, the follow gate, is a tool’s logic layered on top of that single permission.

It is Instagram and Facebook only, because no other platform offers a comment-to-message primitive. TikTok, LinkedIn, X, Threads, and Pinterest let you reply publicly to a comment and nothing more. PostZen’s automations run on Instagram today.

How does Instagram comment-to-DM automation actually work?

Five steps, and the third and fourth are where tools differ:

1. The account is connected through OAuth. The Instagram business or creator account authorises an app that holds Meta’s messaging permission for Instagram. Meta grants that permission after an app review with a screencast, which is why building this yourself starts with weeks of review, not code.
2. Meta sends a webhook when a comment lands. The app subscribes the account to comment and message events. Nothing polls; the comment arrives at the tool within seconds.
3. The tool matches the comment against its rules. Which post, which keywords, which matching mode, which exclusions, whether the commenter is the account itself, whether this person has already been messaged.
4. The tool sends the private reply, and optionally a public reply under the comment. The private reply is a message whose recipient is the comment ID rather than a user ID.
5. The conversation is now open. The DM created a thread, so the commenter can reply and the account can answer inside Meta’s normal messaging window.

Two Meta rules shape every tool built on this:

• One private reply per comment, ever. A second attempt is refused. This is why no tool can DM the same commenter twice for the same comment, and why a retry after a failed send is safe.
• Seven days. The private reply must be sent within seven days of the comment. For Instagram Live, only while the broadcast is live.

The rate is Meta’s too. PostZen paces private replies at 750 per hour per account and holds the overflow rather than letting Meta reject it, so a post that draws 5,000 keyword comments drains over the evening instead of failing at hour one.

How to set up comment-to-DM automation in the PostZen dashboard

The video walks through the whole flow on a real account:

The steps, for reference:

1. Connect the Instagram account. Connections, add Instagram, accept the permissions. Accounts connected since September 12, 2026 already carry the comment and messaging scopes; older ones need a reconnect, and the editor tells you if so.
2. Open Inbox, then Automations, then New. Name the automation and pick the account.
3. Choose the trigger. A comment on a post, or a reply to a story.
4. Choose the scope. Pick a post from the thumbnail grid, choose “any post” for an account-wide rule, or pick a PostZen post that has not published yet so the automation is armed the moment it goes live.
5. Set the keywords. Add the words, choose the matching mode, turn on typo tolerance, and add any exclusion words.
6. Write the DM. Text with up to three link buttons, or an image card with a title, subtitle, image, and buttons. Add message variations if you want the wording to rotate.
7. Optionally add a public reply and a delay for each message.
8. Optionally set the audience to followers only and turn on the follow gate.
9. Save. The phone preview on the right shows the post, the comment thread, and the DM as the commenter will see them. Once it says the automation is live, the next matching comment triggers it.

The comment-to-DM page summarises the feature; the rest of this guide is the detail behind each step.

Which keyword matching mode should you use?

Matching is case-insensitive and accent-insensitive on every mode, so Café matches cafe and GUIDE matches guide. The three modes differ on where the keyword may appear:

Two refinements matter more than the mode:

• Typo tolerance (with word mode) accepts one typo on keywords of four to seven characters and two on longer ones. Three-letter keywords never fuzz, so “DM” and “yes” stay strict.
• Exclusion keywords are checked first with the same mode. “guide” with “no guide” excluded stops the sarcastic comment from getting the link.

Up to 50 keywords and 50 exclusions per automation. An empty keyword list means every comment on the scope triggers, which is occasionally what you want on a giveaway post and never what you want account-wide.

What else can trigger the DM besides a comment?

Story replies. Set the trigger to story_reply and the same keyword rules apply to replies on your stories. A story reply is already a message, so Meta treats the response as a normal DM inside the 24-hour window rather than as a private reply; the one-per-comment rule does not apply, but PostZen still sends one DM per person per automation.

Per-post or account-wide. An automation scoped to a post fires only on that post’s comments. An account-wide automation fires on any post. When both exist, the per-post one wins on its own post and the account-wide ones are skipped there. Account-wide automations stack: several can coexist, tried oldest first, and the first whose keywords match fires. Only one active per-post automation is allowed per post.

A post that has not published yet. Scope the automation to a PostZen post ID instead of an Instagram media ID. PostZen resolves it when the post publishes, so a launch post and its “comment LAUNCH” automation go live together without a race.

A delay. dmDelaySeconds defers the send by up to 24 hours, which reads as more human than a reply in under a second. The match and the dedupe still happen the instant the comment arrives, so a person cannot trigger a waiting automation twice.

How do you stop the wrong people from getting the DM?

Three controls, from simplest to strongest.

Dedupe. A person receives one DM per automation. A second matching comment from the same person is logged as skipped. The account’s own comments never trigger.

Audience. audience.followerStatus narrows the DM to follower or non_follower, and minFollowerCount skips accounts under a size. The catch is Instagram: it only reveals whether someone follows you once that person has messaged you. A comment alone does not count, so for a first-time commenter the follower status is unknown, and whenUnknown decides:

Follow gate. With verify, the commenter gets a message such as “Follow us to get the link, then tap the button below” with a button labelled “I’m following”. The tap is a message, which both grants consent and lets PostZen check the follow status. If they follow, the real DM goes out; if not, they get “Looks like you’re not following yet” with the same button and can tap again once they follow. While PostZen waits, the log shows gated. All three strings are editable.

One consequence of Meta’s one-reply rule: if you set a “not following” message for a known non-follower, that message uses up the comment’s single private reply, and that comment can never receive the real DM afterwards. Set it only when you want that.

Variations are not an audience control but they belong here: up to five alternate DM texts and five alternate public replies, rotated at random, so a thread of 300 identical “sent!” replies does not read as a bot.

What does the API call look like?

Everything the dashboard does is one request. This one watches a post for “guide” or “send it” with typo tolerance, gates unknown commenters behind a follow, sends a DM with a link button 40 seconds after the comment, and posts a public reply 30 seconds after that:

curl -X POST https://api.postzen.dev/v1/comment-automations \
  -H "Authorization: Bearer $POSTZEN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "accountId": "jh72r5nqk9wx3v8m1t4cz6bs0fy5dg3e",
    "name": "Launch guide",
    "trigger": "comment",
    "platformPostId": "17900000000000001",
    "keywords": ["guide", "send it"],
    "excludeKeywords": ["no guide"],
    "matchMode": "word",
    "typoTolerance": true,
    "audience": { "followerStatus": "follower", "whenUnknown": "verify" },
    "followGate": {
      "message": "Follow us to get the guide, then tap the button below 👇",
      "buttonLabel": "I'm following",
      "notFollowingMessage": "Looks like you are not following yet. Follow us, then tap again."
    },
    "dmMessage": "Here is the guide you asked for 👇",
    "dmMessageVariations": ["Got you. The guide is one tap away 👇"],
    "buttons": [{ "type": "url", "title": "Open the guide", "url": "https://example.com/guide" }],
    "dmDelaySeconds": 40,
    "commentReply": "Sent you a DM!",
    "commentReplyVariations": ["Check your inbox 📩"],
    "commentReplyDelaySeconds": 70
  }'

Field by field:

• accountId is the connected Instagram account. platformPostId is the Instagram media ID; use postId with a PostZen post instead, or omit both for account-wide.
• keywords, excludeKeywords, matchMode, and typoTolerance are the matching section above.
• audience and followGate are the gating section. Omit both to DM everyone who matches.
• dmMessage is required unless you send a template (the image card). Up to 1,000 characters, or 640 with buttons. buttons takes up to three url buttons.
• dmDelaySeconds and commentReplyDelaySeconds are 0 to 86,400. The public reply never posts before the DM.

The response is the automation with a stats object. PATCH the same ID to change anything except the account, isActive: false to pause, DELETE to remove it and its logs. Every call and field is in the comment automations docs.

For the image card instead of text, send template with type: "generic", one to ten elements each carrying a title, optional subtitle, a public HTTPS image URL, and up to three buttons; several elements render as a swipeable carousel. If Meta refuses a button template or a card for a particular send, PostZen falls back to text with the links appended and marks the log so you can see it happened.

What happens after the DM: reading the logs

Every trigger writes a log row with the comment, the commenter’s username, the comment text, and an outcome:

The public reply has its own status and never changes the DM’s. GET /v1/comment-automations/{id} returns the 20 newest logs inline; GET .../logs?status=failed pages through the rest. stats.totalTriggered counts every match including skips; totalSent and totalFailed count DM outcomes.

The log is also the answer to “did it work” during a launch. Filter to failed and the reasons cluster fast: a second tool on the same account that already used the private reply, or comments older than seven days from before the automation existed.

Should you build comment-to-DM yourself, buy Manychat, or use an API?

Three routes, and the pricing model is the real difference.

Manychat is the reference point most people arrive from. Its plans have been contact-based since March 2026, starting at 25 contacts on the free plan and 2,500 on Pro, with overage at five cents a contact and a $29 AI add-on; one good Reel can move you a tier. Its API can trigger a flow but cannot create one, so agencies cannot spin up a campaign per client from code. The full comparison, with six other tools, is in our Manychat alternatives guide.

PostZen prices by connected account, and comments, DMs, and triggers are not metered; plans are on the pricing page. The trade is scope: automations are Instagram only, there is no multi-step conversation builder, and the DM is a message with buttons or a card rather than a branching flow. For “comment X, get Y”, that is the whole job. For a support bot, it is not the tool.

Building it yourself is right when the automation is the product. Our Instagram API guide covers the review and the Graph API surface if you go that way.

Can an AI agent set these up for you?

Yes, and this is where an API resource beats a flow builder. PostZen’s MCP server exposes five automation tools alongside its publishing, inbox, and analytics tools:

Connect the server to Claude, ChatGPT, Cursor, or any MCP client, and the prompt does the work: “Watch my latest Reel for the word GUIDE, typo-tolerant, DM the link to example.com/guide with a button, reply publicly ‘sent!’ after a minute, followers only with a follow gate.” The agent lists your accounts, finds the post, and creates the automation, and the same agent can read the logs the next morning and tell you how many people were gated versus sent.

The pattern generalises. An agent that also schedules the post can create the automation against the PostZen post ID before publishing, so the two go live together; an agent running an agency’s accounts can create the same campaign across twenty clients in one conversation. The MCP documentation lists every tool.

Limits to plan around

Not supported yet: Facebook Page comments, matching keywords inside DMs, and click tracking on buttons; the API returns a clear 400 unsupported for each rather than silently ignoring them.

Comment-to-DM is a small feature with a large effect on how a launch goes. The mechanism is Meta’s; the difference between tools is whether you can create the automation from the place your work already happens, a dashboard, a request, or a prompt, and whether the bill scales with your audience or with your accounts. Our social media inbox covers what happens to the replies once the conversation is open.