Before a tool can read comments or send messages for accounts it does not own, Meta has to approve it. This process is called app review. It is slow and detailed, and it is one of the best quality signals you have when choosing a tool.
What app review is
Meta's apps for developers start in a limited mode where they only work for the developer's own test accounts. To work for everyone, the developer must request advanced access to specific permissions and show Meta:
- What the app does, with a screen recording
- Exactly how each permission is used
- A privacy policy and a working data deletion process
- That the business behind it is verified
Meta reviews this and approves or rejects each permission.
The permissions a comment-to-DM tool needs
With Instagram API with Instagram Login:
instagram_business_basic, to see the account and its postsinstagram_business_manage_comments, to read and reply to commentsinstagram_business_manage_messages, to send DMs
The Facebook Login route uses older names such as instagram_basic, instagram_manage_comments, instagram_manage_messages and pages_read_engagement.
What it means for you
- The tool explained its use of your data to Meta. Using permissions in ways not described can lead Meta to remove access.
- It has a privacy policy and data deletion page. Meta checks they exist and work.
- It follows platform rules such as private replies and the 24-hour window, because the API enforces them.
It is not a guarantee of quality or security, but a tool without approval simply cannot work on your account through the official route.
Signs a tool is not approved
- It only works if you add yourself as a "tester" in a developer dashboard
- It asks for your password instead of using Instagram's login
- It has no privacy policy or data deletion page
Frequently asked questions
How long does app review take?
It varies, from days to several weeks, often with several rounds of questions.
Does approval ever get removed?
Yes, if Meta finds an app misusing data or breaking policy.
Does DM Flow have the permissions it needs?
DM Flow uses Instagram API with Instagram Login and the comment and messaging permissions listed above. See our privacy policy for how each is used.
Can I check which apps have access to my account?
In Instagram: Settings and privacy, Website permissions, Apps and websites.