Instagram API permissions
Every scope.What each one allows.
With Instagram Login, the permissions are instagram_business_basic (profile and media, needed by all the others), instagram_business_manage_comments (comments, comment webhooks, private replies), instagram_business_manage_messages (DMs), instagram_business_manage_insights and instagram_business_content_publish. Serving accounts you don't own needs Advanced Access for each.
Updated
# Business Login for Instagram: ask for the scopes you usehttps://www.instagram.com/oauth/authorize ?client_id=<INSTAGRAM_APP_ID> &redirect_uri=<YOUR_REDIRECT_URI> &response_type=code &scope=instagram_business_basic,instagram_business_manage_comments,instagram_business_manage_messages# Old values (business_basic, business_manage_comments, ...)# were deprecated on 27 January 2025. Use the names above.Instagram Graph API permissions list
The reference.Both logins.
Instagram Login names on the left, the older Facebook Login equivalents next to them. Same jobs, different tokens and hosts.
| Instagram Login | Facebook Login | What it allows | Used for |
|---|---|---|---|
instagram_business_basic | instagram_basic | Read the account's profile info and media: username, ID, posts. Every other Instagram Login permission depends on it. | Everything. Also required to refresh a long-lived token. |
instagram_business_manage_comments | instagram_manage_comments | Read, reply to, hide, unhide and delete comments on the account's media, and turn comments on or off. | Comment moderation, public replies, comments and live_comments webhooks, private replies. |
instagram_business_manage_messages | instagram_manage_messages | View, manage and respond to the account's messages. | Sending DMs, messages and messaging_postbacks webhooks, the User Profile API (follow check). |
instagram_business_manage_insights | instagram_manage_insights | Account and media insights. | Analytics. Some metrics aren't available under 100 followers. |
instagram_business_content_publish | instagram_content_publish | Publish organic feed photo and video posts for the account. | Scheduling and publishing tools. |
| Human Agent (feature) | Human Agent (feature) | Reply by hand within 7 days of a user's message, instead of the 24-hour window. | Support inboxes with real people. Needs its own App Review. |
From Meta's permissions reference, Business Login for Instagram, Instagram Platform overview, insights guide and Human Agent feature, checked 9 November 2026. Facebook Login apps also need the Pages permissions shown in the next table. DMpop is not affiliated with Meta or Instagram.
Access levels
Standard orAdvanced?
Standard Access
The default for every app. It covers professional accounts you own or manage, and people with a role on your app. Enough to build and test everything on this page with your own account. No App Review for business-only apps.
Advanced Access
Required to serve Instagram professional accounts you don't own. You get it per permission, through App Review, and Meta requires Business Verification for it. Comment and live comment webhooks need it regardless. The steps are on Meta App Review for Instagram.
Instagram API permissions by use case
What you'rebuilding.
Find your feature, request exactly that. Meta rejects permissions your app doesn't use.
| Use case | Instagram Login | Facebook Login | Meta source |
|---|---|---|---|
| Read comments, reply publicly | instagram_business_basic, instagram_business_manage_comments | instagram_basic, instagram_manage_comments, pages_read_engagement | Comment moderation |
| Comment webhooks | instagram_business_basic, instagram_business_manage_comments + Advanced Access, Live app | instagram_basic, instagram_manage_comments, pages_manage_metadata, pages_read_engagement, pages_show_list | Webhook fields |
| Private reply (DM a commenter) | instagram_business_basic, instagram_business_manage_comments; request instagram_business_manage_messages too (see note) | instagram_manage_comments, pages_messaging with a Page token | Private replies, Messenger version |
| Send and receive DMs | instagram_business_basic, instagram_business_manage_messages | instagram_basic, instagram_manage_messages, pages_manage_metadata | Messaging API |
| Check if a user follows you | instagram_business_basic, instagram_business_manage_messages + the user's consent | instagram_basic, instagram_manage_messages, pages_manage_metadata, pages_read_engagement, pages_show_list | User Profile API |
| Insights | instagram_business_basic, instagram_business_manage_insights | instagram_basic, instagram_manage_insights, pages_read_engagement | Insights |
The private reply note
Meta's docs disagree here. The Instagram Login private replies guide lists instagram_business_basic and instagram_business_manage_comments. Meta's comment moderation guide says that to send private replies your app “also needs” the messages permission, and the messaging guide lists instagram_business_manage_messages for sending messages. A comment-to-DM flow almost always sends a message after the private reply anyway, so request all three.
The follow check needs consent, not just a permission
The User Profile API returns is_user_follow_business only after the person has messaged the account (or tapped an icebreaker or persistent menu). After a comment alone it returns “User consent is required to access user profile.” Details on the Instagram follow check API page.
Unified Login
Meta's overview now lists a third setup, the Instagram API with Unified Login, as recommended for new integrations. It runs on graph.facebook.com, doesn't need a Facebook Page, and uses the instagram_* permission family (instagram_manage_comments, instagram_manage_messages) with Facebook Login for Business checks. Instagram user tokens and graph.instagram.com don't work with it.
Tokens and scopes
Scopes rideon the token.
With Business Login for Instagram, the scopes go in the scope parameter of https://www.instagram.com/oauth/authorize. From Meta's Business Login guide:
- The authorization code is valid for 1 hour and can be used once.
- A long-lived Instagram user token is valid for 60 days.
- You can refresh it for another 60 days once it's at least 24 hours old, if it hasn't expired and the user granted
instagram_business_basic. A token not refreshed in 60 days expires for good.
A token only carries the scopes the user approved. If someone turns off a permission or removes your app in Instagram's settings, calls fail with a permission error (code 10 or 200) or a token error (190). What each means and whether to retry: Instagram API errors.
Or skip the scopes
One key.No App Review.
If you only need comment-to-DM, DMpop's Meta app already holds these permissions. People connect their Instagram through Meta's login, and your code creates campaigns through the REST API or an AI assistant uses the MCP server. Reference in the developer docs.
Building your own? Next read comment webhooks, messaging windows and DM limits.
Questions
Permission questions,answered.
What permissions do I need for Instagram comment-to-DM?
With Instagram Login: instagram_business_basic and instagram_business_manage_comments for the comments, their webhooks and the private reply, and instagram_business_manage_messages for any message after that (a button tap's reply, a follow check). Meta's private replies guide lists only the first two; its comment moderation guide says private replies also need the messages permission. Request all three, with Advanced Access if you serve accounts you don't own.
What does the Instagram manage comments permission allow?
instagram_business_manage_comments is the Instagram Login permission for working with comments on the connected account's media: reading them, replying, hiding, unhiding, deleting, and turning comments on or off. It's also what comments and live_comments webhooks need. It depends on instagram_business_basic. The Facebook Login equivalent is instagram_manage_comments.
What does the Instagram business basic permission allow?
instagram_business_basic is the base Instagram Login permission. Meta: it allows your app to read an Instagram business account profile's info and media. Every other instagram_business_* permission depends on it, and a long-lived token can only be refreshed if the user granted it.
Instagram Login or Facebook Login: how do the messaging permissions differ?
Same job, different login. instagram_business_manage_messages is for the Instagram API with Instagram Login (Instagram user token, graph.instagram.com). instagram_manage_messages is for Facebook Login, where the account is linked to a Facebook Page and you use a Page token on graph.facebook.com. Meta says an app uses one login or the other, not both.
Do I need Advanced Access for these permissions?
Only to serve professional accounts you don't own or manage. Standard Access is enough for your own accounts and people with a role on your app. Advanced Access needs App Review and Business Verification, and comment webhooks need Advanced Access whatever accounts you serve.
Is business_basic still valid?
No. Meta's Business Login guide says the old scope values (business_basic, business_content_publish, business_manage_comments, business_manage_messages) were deprecated on 27 January 2025. Use the instagram_business_* names.
Which permissions does DMpop ask for?
instagram_business_basic, instagram_business_manage_comments, instagram_business_manage_messages and instagram_business_manage_insights, through Meta's own login. Comments and messages run the campaigns; insights power the post stats in the app.
API on every plan
Skip the scopes.Let the DM pop.
DMpop's app already has the permissions comment-to-DM needs. Get an API key on any plan: Free sends 1,000 DMs a month, and paid plans start at ₹99.