Agentic Fabriq
MESSAGING · MESSAGING
Direct messages read and replied to from the Instagram account they sign in with.
Connecting Instagram in practice
Instagram’s rate limit is not a fixed number: the allowance is 4,800 calls in 24 hours multiplied by the account’s impressions in that window, so a quiet account is a tight account. Publishing is separately capped at 100 posts per rolling 24 hours, and JPEG is the only image format the publishing API will accept.
Scopes that draw scrutiny
instagram_business_basicThe baseline scope for the Instagram Login configuration. Serving professional accounts you do not own requires Advanced Access, which means App Review and Business Verification.instagram_business_content_publishPublishes to the account, and is what brings the 100-posts-per-24-hours ceiling into play.instagram_business_manage_messagesReads and sends direct messages, with its own separate messaging rate limits and Meta’s automated-messaging policies attached.instagram_business_manage_commentsModerates comments on the account’s posts, which is visible public action taken in the customer’s name.instagram_basic, instagram_content_publish, pages_read_engagement (plus ads_management and ads_read)The equivalents under the Facebook Login for Business configuration. The two ads scopes become necessary when the user holds their Page role through Business Manager.
Rate limits
- Calls within 24 hours = 4800 × the number of impressions the account’s content received in that window.
- Content publishing: 100 API-published posts per rolling 24 hours, where a carousel counts as one post. GET /content_publishing_limit reports current usage.
- Conversations API: 2 calls per second per account.
- Private Replies: 100 calls per second on Live, 750 per hour on posts and reels.
- Send API: 100 calls per second for text and links, 10 calls per second for media.
Who has to approve
Standard Access only covers Instagram professional accounts you own or manage yourself. Serving anyone else’s account requires Advanced Access, which Meta grants only after both App Review and Business Verification — a process measured in weeks, not minutes.
Worth knowing
- Long-lived tokens are valid for 60 days and can only be refreshed once they are at least 24 hours old, so refreshing too eagerly leaves the token on its original clock.
- The pre-2025 scope names were deprecated on 27 January 2025 in favour of the instagram_business_* set, so older sample code authorizes nothing.
- Publishing accepts plain JPEG only — no MPO or JPS — no filters, no shopping tags, a maximum of 10 carousel items all cropped to the first item’s aspect ratio, and media must sit on a publicly reachable URL at the moment of publication.
- Because the 24-hour allowance is a multiple of impressions, a new or low-reach account has almost no quota, which is the opposite of the pattern most integrations are tested against.
Checked against Business login for Instagram (2026-09-29), Content publishing (2026-09-29), Instagram Platform overview (2026-09-29)
What an agent can do
Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.
Often connected alongside
Put Instagram behind one governed endpoint.
Same permissions, same audit trail, whatever else you connect next.