Instagram setup

This page is the checklist. Instagram DM automations is what you build once the checklist is done.

What do I need before Zippy can DM people for me?

Two things, both inside the Instagram app, both free.

A personal account can't automate DMs at all — Instagram doesn't expose messaging for one, so there's nothing any tool can hook into. Switching to Professional is free, takes a minute, and doesn't change how your profile looks to followers.

Number 2 is the one people miss. Without it Instagram won't hand your messages to any connected tool, and the connection will look fine while nothing ever fires.

Do I need a Facebook Page?

No. Zippy uses Instagram Login, which Meta documents as not requiring a Facebook Page to be linked to your Instagram professional account. There's no Page to create, no Business Manager, and nothing to link — you sign in with Instagram itself.

Some tools in this category do ask for a Page, because they use Meta's other flow (Facebook Login for Business). That's their integration choice, not an Instagram requirement, and it isn't one you inherit by using Zippy.

Zippy shows this same checklist above the connect button in the dashboard, so you never have to hold it in your head.

Which permissions does Zippy ask Instagram for?

Three scopes, and nothing else:

These are the scope names for Instagram Login — the connect flow Zippy uses. The older Facebook-Login-for-Business flow uses different names (instagram_manage_messages, instagram_manage_comments, plus pages_*); they are not aliases for each other, so if you're comparing us to another tool's permission screen, expect the wording to differ.

We do not ask for permission to post, to read your followers, or to touch your Facebook Page beyond the link Instagram requires.

How does Zippy store my Instagram access?

Instagram hands us a long-lived access token. That token can read and send your DMs, so:

• Encrypted at rest with AES-256-GCM, under a key that lives only in our server environment — never in our code, never in a browser.
• Bound to your account. The encryption is tied to your Instagram account id, so a stolen ciphertext can't be replayed against a different connection.
• Never readable back. There is no "reveal token" button, not for you, not for us, not for support. Unlike a webhook signing secret, it isn't even shown once at creation.
• Never in an error message. Meta's error responses quote your request back at you, token included, so we keep the numeric code and throw the body away.

Tokens last 60 days. Zippy renews yours automatically about a week before it expires. If a renewal fails, your connection flips to Needs reconnect and the dashboard says so loudly — it never quietly stops working.

What happens when my connection breaks?

Your automations pause. They do not disappear.

Every rule, its history, and its stats stay exactly where they were. Press reconnect and they pick back up. This is the same promise as the rest of Zippy: a link never stops redirecting, and an automation never silently drops a message without telling you why.

The same holds for your plan. DM automations are a Legend feature; if you downgrade, your rules go read-only rather than being deleted, and every skipped DM is recorded with the reason in plain language.

What actually works today

Plainly, because you deserve the real state and not a roadmap in a trench coat:

So: you cannot connect an Instagram account to Zippy today. The connect button reads "Instagram DMs aren't switched on yet" because the Meta credentials aren't provisioned, and it turns on by itself the moment they are.

After that there's a second gate. A new Meta app starts in development mode, which means Instagram only delivers events for accounts that have a role on the app. In that state you can build and test rules against your own account, but your real followers' comments won't reach us. Going live for everyone needs Meta's App Review, which is a human review with a screen recording of a working app — which is precisely why the feature gets built before it gets submitted, and not the other way round.

And a third gate: Business Verification

App Review is not the last door, and this is the one nobody mentions until you're standing in front of it — so here it is up front.

The permissions Zippy needs are Advanced Access permissions, and Meta requires Business Verification before an app may use Advanced Access to serve people who don't hold a role on it. In practice:

So the order is: build → test against real Instagram accounts → run a closed beta with testers we add by hand — all of that works with no verification at all. The moment we want self-serve public signup, verification is mandatory.

It is not a form we can fill in cleverly. Meta asks for a registered business entity — legal name, registration number, and official documents that match — and then reviews them. That's a real-world step with a real-world lead time, not an afternoon.

We're telling you this on the checklist page rather than after App Review, because the failure mode we refuse to ship is a creator clearing one gate and discovering a wall nobody mentioned.

The dashboard tells you which of these states you're in, before you invest time in building rules. It will never say "you're live" when you aren't.

Related

• Instagram DM automations — the rules themselves: triggers, the DM body, the link, and how to read what happened.
• ManyChat — works right now, on any ManyChat plan, with no approval from anyone: paste a Zippy link into your existing comment-to-DM flow and the tap opens the real app. If you want the outcome today, that's the page.
• Webhooks — app.opened / app.browser / app.broken, the same outcome events that make DM stats mean something.
• Audience segments — slice the taps your DMs produced by country, device, and whether the app actually opened.
• Email capture — turn a tap into a contact you own outright.
• Blog: ManyChat DMs a link that dies in the in-app browser
• Changelog: Instagram DM automations and keyword, story reply & story mention triggers