Quick start · How it works · User guide · Roadmap · Contributing · Security

Someone comments "guide" on your reel. They get a DM with your link, automatically, about two seconds later.

That is the entire product. Tools that do this start around $15/month and want your Instagram login on their servers. This is the same thing, running on your Cloudflare account, on the free tier, for $0 — and you can read all 4,400 lines of it in an afternoon.

It uses Meta's official Graph API through Instagram Login. No scraping, no browser automation, and it never sees your Instagram password.

flowchart LR
    A["💬 Someone comments<br/>&quot;guide&quot;"] --> B{{"Meta webhook<br/><i>HMAC signed</i>"}}
    B --> C["⚡ Your Cloudflare Worker"]
    C --> D{"Is it you?"}
    D -->|yes| X["🚫 ignored"]
    D -->|no| E{"Already handled?"}
    E -->|yes| X
    E -->|no| F{"Matches a<br/>keyword rule?"}
    F -->|no| Y["📝 logged as skipped"]
    F -->|yes| G["📨 One private DM"]
    G --> H["💭 Optional public reply"]

    P["⏱ Every 5 minutes"] -.->|"catches what the<br/>webhook missed"| C
    N["🌙 Nightly 03:00 UTC"] -.->|"refreshes the<br/>60-day token"| C

    style A fill:#FD1D1D,stroke:#833AB4,color:#fff
    style C fill:#F38020,stroke:#833AB4,color:#fff
    style G fill:#22aa66,stroke:#0a5,color:#fff
    style X fill:#eee,stroke:#999,color:#333
    style Y fill:#eee,stroke:#999,color:#333

Two independent delivery paths. The webhook is the fast one — a DM lands in about two seconds. The five-minute poll is the safety net, because Instagram quietly drops webhooks for collapsed and low-signal comments. A comment that the webhook missed still gets its DM, just a few minutes later.

Everything lives in one Worker and one SQLite database:

You need Node.js 20+, a free Cloudflare account, and an Instagram professional account (Creator or Business — switch in the app under Settings → Account type and tools).

git clone https://github.com/CharanMN7/ig-comment-dm.git
cd ig-comment-dm
npm install
npx wrangler login

npm run setup

npm run setup creates the database, generates every secret at the right size, deploys, and finishes by printing the exact strings to paste into Meta's dashboard:

[1/6] Checking your Cloudflare login
[2/6] Creating the database and deploying
[3/6] Creating the database tables
[4/6] Your three values from the Meta dashboard
[5/6] Generating the rest
[6/6] Deploying again so the secrets take effect

Done. Your copy is live.

It is safe to re-run, and it will not rotate secrets you already have.

Stuck? Run npm run doctor. It checks your live deployment and tells you what is missing in plain words.

git remote add upstream https://github.com/CharanMN7/ig-comment-dm.git
git pull upstream master
npx wrangler deploy

Open your admin URL (printed by npm run setup — bookmark it) and create a password on the first visit. Then Accounts → Connect a new account.

You can connect several Instagram accounts to one deployment. Each one needs to be an Instagram Tester on your Meta app.

Rules → New rule.

Matching ignores case, emoji, and punctuation, and matches whole words. A rule scoped to a specific post beats a rule that applies to everything.

Test → paste a sample comment. It shows which rule would fire. Nothing is sent.

Then comment from a different Instagram account — a friend's phone works. Your own comments on your own posts are ignored deliberately.

Instagram's rules, not ours. Each of these is enforced by Meta and cost someone an evening to discover.

Everything below is an open issue. Comment on one to claim it — good first issue items are self-contained and have the approach sketched out.

Issues and pull requests are welcome. good first issue items are self-contained and describe the approach.

npm install
npm test          # 30 unit tests, no network, no database
npm run typecheck
npm run dev       # http://localhost:8787

Read CONTRIBUTING.md first — particularly the constraint that keeps this project usable: one runtime dependency, no build step, no client-side JavaScript.

Found a security problem? Do not open an issue. See SECURITY.md.

Star history

MIT licensed · Built on Cloudflare Workers and Hono

_{Not affiliated with, endorsed by, or sponsored by Meta or Instagram.
Instagram is a trademark of Meta Platforms, Inc.}