How to Auto-DM Everyone Who Comments a Keyword on Instagram

The pattern is everywhere at this point: a post asks people to comment a specific word, and within seconds a DM shows up with a link, a discount code, a resource, whatever was promised. It looks like magic if you've never set one up. It's actually a fairly small, specific mechanism — and understanding how it actually works makes it much easier to get right.

What's really happening, step by step

Instagram lets an approved app subscribe to webhook events for a Professional account — meaning Instagram itself pushes a notification the instant something happens, rather than the app having to constantly ask "anything new?" When someone comments on a subscribed post, that comment's text and ID land at the app within roughly a second of being posted.

From there it's pattern matching: does the comment contain the keyword the account owner configured? If yes, the app calls Instagram's Messaging API with that commenter's ID and the message content, and Instagram delivers it to their DMs. If no, nothing happens — the comment sits there like any other. The entire round trip, comment to DM in someone's inbox, usually finishes in under a second.

None of this requires a person watching the post. It doesn't require the account to be logged in anywhere except the one authorization that set up the subscription in the first place. It just requires the webhook to be listening and the keyword match to be correct.

Picking a keyword that doesn't backfire

The keyword is the only part of this a normal conversation can accidentally trigger, so it matters more than people expect. "Yes," "link," "info," or "more" show up constantly in comments that have nothing to do with your offer — someone agreeing with another commenter, asking an unrelated question. Match on a word like that and you'll send your DM to people who never meant to ask for anything.

A specific, slightly unusual phrase — a made-up code word, a product name, an emoji combo — almost never appears by accident, so it only fires when someone actually intends to trigger it. It also reads as more deliberate to anyone scrolling the thread, which happens to help with the spam-pattern problem covered in the hidden-comments post above.

Why the DM doesn't always arrive

Two things outside the automation's control affect delivery. First, Instagram's own messaging permissions: if someone has their DMs restricted from accounts they don't follow, a cold message-request folder is where it lands instead of their main inbox — still delivered, just less visible to them. Second, rate limits: Meta caps how many messages any one account can send in a given window, mostly relevant to accounts already sending high volume.

Plain text isn't the only format, and the format changes outcomes

A bare text message is the simplest option, and it's fine for a lot of cases. Two other formats change what happens next in ways worth knowing about:

• A tap-to-reveal button sends a message with a single button instead of the raw link — the recipient has to tap it to actually open the destination. That extra tap filters out people who commented on impulse and never really wanted the thing, so click data on the other end is cleaner.
• A two-step confirm goes further: first message asks them to tap "yes, send it," and only delivers the actual link after that second action. Slower, but it produces the warmest possible list — everyone who makes it to the end genuinely wants what's on the other side.

Which one's right depends entirely on what you're optimizing for. Plain text maximizes reach. The two-step approach maximizes intent. There isn't a universally correct choice.

How to actually know it's working

Don't rely on the visible comment count as your metric — as covered in the hidden-comments piece, Instagram can hide a chunk of a busy thread from public view without affecting whether the DM went out. The number that actually matters is in your automation's own delivery log: who commented, what keyword matched, whether the message sent successfully, and when. If that log shows sends happening and the comment count looks lower than expected, it's very likely a visibility artifact, not a broken automation.

The honest caveat

This entire mechanism requires the account be set up as an Instagram Professional (Business or Creator) account connected through Instagram's own official login flow — a personal account can't authorize the API access this depends on. And every plan tier of any tool built this way will have some monthly cap on how many messages can go out, because Meta itself caps API usage per app. Nothing about this is unlimited by nature, and any claim otherwise is worth being skeptical of.