They comment “guide”. Two seconds later, they have your link.

Instagram lets an account send about 750 private replies an hour and refuses the rest. So the Worker sends at most 12 DMs a minute per account, which keeps every hour under the limit, and queues the others. A job every minute works through the queue, oldest comment first: 5,000 comments on one reel clear in about 7 hours.

Queued

Waiting its turn under the hourly limit.

Retrying

Instagram said “not now”: the account was sending too fast, or Instagram had a temporary error. Tried again after 1, 5 and 20 minutes.

May have been delivered

Instagram’s answer never came back. The Worker won’t send it again by itself, because a second try could reach the same person twice. Send again is there once you’ve checked.

Expired

Still waiting an hour before Instagram’s 7-day cutoff for private replies, so it was skipped.

Those are the labels on Home, next to every send. Each comment is claimed in the database before its DM goes out, so a webhook Meta delivers twice, or a comment that both the webhook and the poll find, still gets one DM.

The admin panel lives at a URL with a 128-bit secret in it, behind a password. After five wrong passwords, each wait doubles from a minute up to an hour, and guesses sent in parallel are counted one at a time. Logging out ends every session, on every device.

Every webhook is checked against Meta’s signature before it’s parsed, and forged ones can’t fill your database. Instagram tokens are encrypted with AES-256-GCM under a key that exists only in your Cloudflare account. No JavaScript runs in the panel: its Content-Security-Policy is default-src 'none'.

Security covers what isn’t defended against, and how to report a problem privately.

# Node.js 22.13+ and a free Cloudflare account
git clone https://github.com/CharanMN7/ig-comment-dm.git
cd ig-comment-dm
npm install
npx wrangler login
npm run setup

npm run setup deploys the Worker, creates the database, generates every secret at the right size, and prints the exact values to paste into Meta’s dashboard. The Meta side (creating an app, adding yourself as a tester, publishing it) is the slow part, and the guide shows every screen. Updating later is one command too:npm run update.

• Self-setup guide: Cloudflare and the Meta developer app, step by step.
• Agent setup guide: Claude Code and Claude in Chrome do the clicking. You keep the logins and the secrets.

Meta’s rules and Cloudflare’s free plan, not ours. Each one has cost someone an evening, so here they are up front.

• Professional accounts only. Instagram’s API doesn’t work with personal accounts. Switching to Creator or Business takes a minute in the app, under Settings → Account type and tools.
• You need your own Meta developer app, and it has to be Live. An app in Development mode only receives the dashboard’s Test button, never real comments. Publishing needs no App Review while only your own accounts connect as Instagram Testers; App Review is for letting other people connect theirs.
• One DM per comment, ever. Instagram allows one private reply per comment, and no follow-up unless the person replies first. Put everything in that message.
• Comments older than seven days can’t get a private reply. They’re logged as skipped.
• Hidden Words wins. Comments Instagram’s filter hides never reach the API, so nothing can answer them.
• Not following you? Message requests. A DM to someone who doesn’t follow you lands in their Message requests folder, not their inbox.
• About 750 private replies an hour per account. Meta’s cap. The Worker stays under it at 12 a minute and queues the rest, so on a reel that takes off some DMs arrive minutes or hours late.
• About 6,000 to 7,500 DMs a day on the free database. Cloudflare’s free D1 plan allows 100,000 rows written a day, and each DM writes 13 to 16. Past that, D1 refuses everything until midnight UTC.