Instagram: the 24-hour reply window

No app may start an Instagram conversation. What that means for a birthday message.

What Meta and Instagram actually permit in 2026, checked rather than assumed. Every line traces to a source at the bottom.

Professional API:                        SUPPORTED
Personal-account API:                    UNSUPPORTED
Server-side scheduled sending:           SUPPORTED  (Professional, conditional)
Native Instagram scheduling:             SUPPORTED  (in-app only, 29 days)
Third-party invocation of native:        UNSUPPORTED
Device-independent delivery:             SUPPORTED  (Professional, conditional)
                                         UNSUPPORTED (personal, unconditional)

The word doing the work is conditional, and it is explained under "Important restrictions". Skipping it produces a product that lies.

Professional API - SUPPORTED

Two routes exist. The newer one matters because it removes a requirement people usually assume is unavoidable.

Instagram API with Instagram Login - "does not require a Facebook Page to be linked to the Instagram professional account." Authentication is Business Login for Instagram: the user signs in to Instagram directly, with no Facebook account in the loop. Creator accounts need no linked Page at all.

Instagram API with Facebook Login - the older path, Page-linked.

SentLoop should prefer Instagram Login. It is fewer steps, fewer accounts, and it is the difference between "connect Instagram" and "first create a Facebook Page".

Required permissions

instagram_business_basic              base scope, required alongside
instagram_business_manage_messages    reading and sending DMs

Both need Advanced Access and therefore Meta App Review. Until that is granted the app can only message accounts with a role on it, which is a real constraint on any consumer launch and not a formality.

Server-side scheduled sending - SUPPORTED, conditionally

This is the brief's central goal and it genuinely works for Professional accounts:

SentLoop scheduler  →  Meta Send API  →  Instagram  →  Recipient

No device of the user's is involved. The phone can be off. SentLoop's backend wakes at 08:00, re-checks eligibility, and calls Meta. That is true device-independent delivery, and it is already exercised by npm run verify:instagram.

The condition is who you may send to, not when.

Personal-account API - UNSUPPORTED

There is no Instagram API for personal accounts. Not restricted - absent. No OAuth scope, no endpoint, no review process that grants one.

Anything advertising personal-account DM sending is driving the private mobile protocol or a logged-in session. Both are forbidden by the brief and by Meta's terms, and SentLoop does neither.

Native Instagram scheduling - SUPPORTED in-app, UNSUPPORTED for third parties

Instagram shipped native DM scheduling: type the message, press and hold the send button, pick a date and time, up to 29 days ahead. A banner in the thread shows how many are pending. It works for personal accounts, which is exactly where the API cannot reach.

So the obvious question is whether SentLoop can ask Instagram to do that. It cannot, and the reason is structural rather than a missing permission.

Instagram's entire documented third-party surface is Stories sharing:

Platform	Mechanism
iOS	`instagram-stories://share?source_application=%@`, plus pasteboard keys such as `com.instagram.sharedSticker.backgroundImage`
Android	Implicit intent `com.instagram.share.ADD_TO_STORY`

There is no documented URL scheme, intent, share extension, App Intent or Shortcuts action for composing, sending, or scheduling a DM.

And even if Instagram published an App Intent tomorrow, it would not close this. App Intents are invoked by Siri, Shortcuts, Spotlight and the Action button - not by an arbitrary third-party app calling into another app's process. The user could build a Shortcut; SentLoop's server could not trigger one. That is device-assisted by definition, which is a different product claim.

This mirrors the finding in APPLE_API_FINDINGS.md for iMessage: a native scheduling feature existing is not the same as a third party being able to invoke it.

Important restrictions

Conversations are user-initiated. Meta: "Conversations only begin when an Instagram user sends a message to your app user." There is no cold DM through the official API, at any tier, for any account type.

The 24-hour window. Once someone messages you, you may reply freely for 24 hours. Outside it the API refuses.

Marketing Messages - the one mechanism that reaches outside the window, and it does not do what it first appears to. The opt-in request itself may only be sent inside the 24-hour window, and opting in does not reopen that window. So it still requires the person to have messaged first. It is also scoped to the topic they opted into: using it to carry "want to play soccer tomorrow?" would be using a marketing channel for something it was not approved for, which SentLoop will not do for the same reason it refused to reuse an order-confirmation template on WhatsApp.

Human Agent tag extends to 7 days, for customer support handoffs. A birthday note is not customer support.

Rate limits. Meta enforces per-account throughput; Instagram's own anti-spam systems add a practical ceiling well below it. Treat 429 and policy errors as distinct: one is temporary, the other is permanent, and retrying the second is how an account gets restricted.

What this means for SentLoop

Account	Route	Phone needed?
Professional, recipient messaged in last 24h	Meta Send API, server-side	No
Professional, opted into a Marketing Message topic	Marketing Messages, server-side, topic-scoped	No
Professional, no prior contact	Nothing sends. Handoff.	Yes
Personal, any recipient	No API exists. Handoff, or native scheduling by hand.	Yes

The honest headline: SentLoop can deliver Instagram DMs with the phone off, for Professional accounts, to people who have messaged you. Everything else is a handoff, labelled as one.

Not verified here

Test 1 (Professional, phone off) was not run end to end against a live account. This deployment has no Instagram Professional account connected - connecting one needs the account holder. The code path is exercised against a stubbed Meta endpoint by npm run verify:instagram, which asserts an in-window send goes out automatically and an out-of-window one is never recorded as sent.
Test 2 (personal, native scheduling) is not possible. There is no supported mechanism to invoke, so there is nothing to test. Documented rather than attempted, per the brief.
Whether Instagram's native scheduling survives the phone being offline at delivery time was not tested. It is not reachable by SentLoop either way, so it does not change any product decision.