Meta App Review for Instagram messaging
App Review,without theguesswork.
To message or read comments for Instagram accounts you don't own, your app needs Advanced Access, and Meta grants it only through App Review plus Business Verification. You submit a screencast per permission, usage notes, working test logins and a privacy policy. Meta doesn't publish a review time, and nobody can promise approval.
Updated
Meta's two access levels
- Standard Access
- The default. Accounts you own or manage, and people with a role on your app. No review for business-only apps.
- Advanced Access
- Required to serve Instagram professional accounts you don't own. Needs App Review and Business Verification.
Source: Meta's Instagram Platform overview, checked 9 November 2026.
Advanced Access for Instagram: do you need App Review?
Whose accounts?That decides it.
The question isn't which feature you use. It's whose Instagram accounts your app serves.
Only your own accounts: Standard Access
Meta's overview calls Standard Access “the default access level for all apps”. It covers professional accounts you own or manage. Meta's Instagram App Review page says business-only apps on Standard Access don't need review. The catch for messaging: Standard Access apps can only message people who have a role on the app, so you can test, but not serve the public.
Anyone else's accounts: Advanced Access
“Advanced Access is the access level required if your app serves Instagram professional accounts that you don't own.” The same page says your app “must complete Meta App Review” to get it, and that you must complete Business Verification if your app requires it. A tool you sell to creators, brands or clients is in this group. So is an agency app that connects client accounts.
Webhooks need it too
Comment notifications only arrive for a Live app with Advanced Access. That's the most common reason a comment-to-DM prototype works in testing and goes quiet in production. More on comment webhooks not working.
Pick the login first
Meta says an app can use Facebook Login or Instagram Login, but not both, and that web is the only platform that currently supports the Instagram API with Instagram Login. Permission names differ by login. The full map is on Instagram API permissions.
Meta App Review checklist for Instagram
Before youpress submit.
Collected from Meta's Instagram App Review page, its create-an-app guide and its data deletion docs. Each step links to its source.
- A verified business. Meta's create-an-app guide: you must connect the app to a business that has completed Business Verification before you can publish it.
- App settings filled in. An app icon (1024×1024), a privacy policy URL people can open, an app category and a business email (App Review page).
- A way to delete data. Apps that access user data need a Data Deletion Request URL: either a callback or an instructions page, over HTTPS (data deletion callback). Your privacy policy should explain it too.
- At least one successful API call for each permission you request with Advanced Access.
- Step-by-step reviewer instructions and a working test login for your app. For messaging apps, Meta says not to include personal Facebook or Instagram details or Facebook test user credentials (Instagram messaging App Review).
- One use-case note and one screencast per permission. Describe how the app uses it, record the whole flow, and agree to the allowed usage.
- Dependencies included. If a permission depends on another, request both. The Instagram Login permissions depend on
instagram_business_basic. - Nothing extra. Drop every permission the current build doesn't use.
instagram_business_manage_messages and comments: what to show
Per permission.What to record.
From Meta's permissions reference and its Instagram messaging review guide. For a comment-to-DM app you'd typically request the first three.
| Permission | What it allows | What Meta asks to see |
|---|---|---|
instagram_business_basic | Read the account's profile info and media. | A screencast of the Instagram login flow in your app. |
instagram_business_manage_comments | Read, reply to, hide and delete comments. Needed for comment webhooks and private replies. | Demos of your app working with comments (Meta's entry asks for creating, updating and deleting). Depends on instagram_business_basic. |
instagram_business_manage_messages | View, manage and respond to the account's messages. | A recording of your app sending a message and the Instagram inbox receiving it, plus the cURL request. Depends on instagram_business_basic. |
| Human Agent | Reply by hand within 7 days of a user's message, instead of 24 hours. | Only if you have a custom inbox for human escalations. Explain why a reply can take up to 7 days. |
From Meta's permissions reference and Instagram messaging review guide, checked 9 November 2026. When we checked, the reference entry for instagram_business_manage_comments repeated the publishing permission's description, so we've used its screencast notes and Meta's comment moderation guide.
The screencast, done right
- Record the same app you're submitting.
- Use English as the app's UI language where you can. Add captions or tooltips for anything that isn't.
- Explain any button whose meaning isn't obvious.
- Start at login. Meta asks for the Instagram login flow for
instagram_business_basic, so show your connect button, the professional account signing in and the consent screen. - For messaging, show the message leaving your app and arriving in the Instagram inbox. Meta's messaging review guide also asks automated experiences to show a reply to a user message within 30 seconds, and how it escalates to a human.
- For comment-to-DM, show a comment from a second account, the private reply going out, and it landing in that account's DMs.
# The kind of cURL request Meta asks to see for# instagram_business_manage_messages: your app sends, the inbox receivescurl -X POST "https://graph.instagram.com/v27.0/<IG_ID>/messages" \ -H "Authorization: Bearer <INSTAGRAM_USER_ACCESS_TOKEN>" \ -H "Content-Type: application/json" \ -d '{ "recipient": { "id": "<IGSID>" }, "message": { "text": "Hi! Thanks for your message." } }'App review Instagram API rejected: Meta's common mistakes
Rejected?Usually one of six.
These six come from Meta's own list of common App Review mistakes. Meta doesn't publish per-permission rejection statistics.
Access01
Your app is inaccessible.
Meta: if reviewers can't get into your app, the entire submission is rejected. Give working test login details and step-by-step instructions.
Screencast02
A recording is missing.
Each permission or feature needs a screen recording of it in use. One permission without one fails.
Timing03
Still in development.
Submit when the app is finished and ready for end users, not to find out whether an idea is allowed.
Scope04
Asking for later.
Only request what the app uses now. Meta's Instagram App Review page: permissions your app doesn't use, or that don't fit the allowed usage, won't be approved.
Login05
Login can't be found.
Reviewers must be able to find your login button and sign in. For Instagram Login, that's your “Connect Instagram” step.
Accounts06
A fake account.
Fake accounts break Meta's terms. Use a real test professional account, not a personal one or a Facebook test user.
Source: Meta's common App Review mistakes and Instagram App Review page, checked 9 November 2026.
Meta App Review timeline
How long?Meta doesn't say.
None of the Meta App Review pages we checked gives a review time, so this page doesn't either. Reports in Meta's developer community vary; one thread describes an Instagram messaging review still waiting at 13 days. Leave room for a resubmission in your launch plan, and don't schedule a launch on the assumption you'll pass first time.
What helps, according to Meta's own list: a finished app, a login that works, one clear recording per permission, and nothing requested “for later”. Already had Advanced Access on the older Facebook Login permissions? Meta's review page says migrated apps may get the Instagram Login equivalents automatically; otherwise they're submitted for review.
Instagram comment-to-DM without your own App Review
Or build onan approved app.
When your own review makes sense
You're building a product on Instagram messaging: a shared inbox, a CRM, a support desk, a custom chatbot. You need raw access to conversations, so you need your own reviewed app. Nothing replaces that.
When it doesn't
You want “comment a keyword, get the link” inside your own app, script or workflow. DMpop's Meta app handles the permissions, webhooks, polling fallback and limits. Your code calls the REST API with a key from Settings, or an assistant uses the MCP server. Each account connects through Meta's own login.
The trade-off: the API manages campaigns. It can't send arbitrary DMs or read inboxes. Reference in the developer docs; agencies, see DMpop for agencies.
Questions
App Review questions,answered.
Do I need App Review to use the Instagram API?
Not for accounts you own or manage: Standard Access, the default, covers those, and business-only apps on Standard Access don't need review. You need App Review for Advanced Access, which is required to serve Instagram professional accounts you don't own. Meta also requires Business Verification for Advanced Access.
How long does Meta App Review take?
Meta's App Review pages we checked don't state a review time, so we won't guess. Reports in Meta's developer community vary. Plan for back-and-forth: a rejection usually means fixing the screencast or instructions and resubmitting.
Why was my Instagram messaging permission rejected in App Review?
Whether it was instagram_business_manage_messages or another permission, Meta's listed common mistakes are: the app was inaccessible, a screen recording was missing, the app was still in development, a permission was requested for later, the login couldn't be found or didn't work, or a fake account was used. For messaging, Meta wants the recording to show your app sending a message and the Instagram inbox receiving it, with the cURL request.
Do I need Business Verification for Instagram API access?
For Advanced Access, yes. Meta's Instagram Platform overview says you must complete Business Verification if your app requires Advanced Access, and its create-an-app guide says the app must be connected to a verified business before you can publish it.
Can one app use both Instagram Login and Facebook Login?
No. Meta's Instagram App Review page says an app can use either Facebook Login or Instagram Login, but not both. It also says web is currently the only platform that supports the Instagram API with Instagram Login.
Is there a way to do comment-to-DM without my own App Review?
Yes: build on a provider whose Meta app already has Advanced Access. DMpop's REST API and MCP server let your code create comment-to-DM campaigns through DMpop's app. You don't get raw messaging access, though: no arbitrary DMs, no inbox. If you're building an inbox or CRM, you need your own reviewed app.
What happens if I request permissions my app doesn't use?
Meta says they won't be approved. Request only what your current build uses, and include any permission the main one depends on (for example instagram_business_basic for the manage_comments and manage_messages permissions).
No App Review needed
Build on ours.Let the DM pop.
DMpop's API and MCP server are on every plan. Free sends 1,000 DMs a month, and paid plans start at ₹99. Connect Instagram through Meta's own login; no password.