Every Instagram Messaging API limit, in one table

Instagram messaging is available through two Graph API routes - the original Messenger Platform route, where a Facebook Page linked to the Instagram professional account does the talking, and the Instagram API with Instagram Login, which since July 2024 needs no Page at all. The ceilings below apply to both unless a row says otherwise; where the routes genuinely differ (media formats, permission names, account prerequisites), the row names its route. Every value is quoted from Meta's documentation and carries the source link - nothing here is inferred or folklore.

The limits fall into three tiers of pain. The policy tier is absolute: the 24-hour messaging window, the 7-day human-agent extension, and the one-per-comment private reply cannot be engineered around, only designed for - crossing them produces error 10/2534022 and its relatives, and persistent violation ends in an account-level block. The throughput tier - 100 Send API calls per second per account for text but only 10 for audio and video, 2 conversation reads per second, 750 private replies per hour on posts - throttles you with 613/2534040 and (#4) when bursts exceed it. The content tier caps what a single message may hold: 1,000 characters of text, 8 MB images, 25 MB video, 13 quick replies, 10 carousel cards, 4 ice breakers.

Two prerequisites gate everything and fail silently rather than loudly: the account must be a professional account, and the Allow access to messages toggle must be on in the Instagram app. If your integration returns errors, the code-by-code companion is the Instagram error reference; if it returns nothing at all, start with the troubleshooting guide. For building on these constraints rather than against them, see the Instagram chatbot overview.

The window is Instagram messaging's defining constraint: apps may only message a person within 24 hours of that person's last message, and the send that misses it fails with error 10/2534022, documented as "This message is sent outside of allowed window." Instagram is deliberately stricter than its siblings - the Messenger message tags that reopen conversations elsewhere are documented as not available here, and there is no WhatsApp-style template mechanism. The single extension is the human_agent tag: 7 days, humans only, granted through App Review. Everything else is re-entry design - ice breakers, story interactions, and comment-triggered private replies that prompt a fresh inbound message.

Instagram messaging calls are counted per Instagram professional account and per API, so ceilings travel with the account - a viral account cannot be scaled around by adding servers. Text sending is generous at 100 calls per second, but media sending is a tenth of that, and conversation reads are a tight 2 per second, which is why bots that re-read threads on every webhook event throttle at trivial scale. Exceeding a messaging ceiling returns 613/2534040; exhausting app-wide or Page budgets surfaces as (#4), (#17) or (#32). Watch the X-App-Usage and X-Business-Use-Case-Usage response headers, including estimated_time_to_regain_access, before the errors arrive.

Instagram supports a narrower message surface than Messenger, with hard caps on each structured type. Payloads that exceed them are rejected as parameter errors - typically code 100 or the Instagram-specific 100/2534015 ("Invalid message data") - so cross-platform senders should validate against these numbers, not Messenger's, ideally in a schema check that runs before the API call. Quick replies, ice breakers and the persistent menu are documented as unavailable on desktop, which matters when reproducing customer reports: a missing menu on the web client is expected behavior, not a bug in your integration.

Media ceilings are small by phone-camera standards - 8 MB for images, 25 MB for everything else - and the two API routes document slightly different format lists, so normalize assets before sending rather than forwarding originals. Oversized files fail with 100/2018109, unreachable URLs with 100/2018008, and slow or corrupt video with 100/2018294, whose 75-second fetch budget is documented explicitly. Remember that Meta fetches URL-sent media from its own servers, not from the recipient's device: files must be publicly reachable, served with a valid TLS certificate, and fast enough to download well inside the timeout.

Private replies convert a public comment into a direct message, and they are Instagram's most valuable re-entry tool precisely because their window is independent of the DM window. The rules are strict and per-comment: one reply, within 7 days for posts, ads and reels, live-broadcast-only for live comments. Violations return error 100/2534025 ("The comment is invalid for a private reply"), and campaign-scale automation additionally runs into the 750-per-hour ceiling listed under rate limits. Build these automations as real-time consumers of the comments webhook, not batch sweeps over old comments.

Story interactions arrive as normal messages webhook events - a reply to your story carries a reference to the story, and a mention of your account in someone else's story arrives with a story_mention attachment - and both count as inbound messages that open the standard 24-hour window. The constraints are about visibility and lifetime rather than volume: mention webhooks only flow from public accounts (or private accounts that follow you), and the media URL dies with the story. Fetch what you need immediately; a dead CDN URL is not an API error like 100/2018008, it is documented expiry.

Deliverability on Instagram is not only about API acceptance - the account's inbox has documented behavior of its own. Meta publishes a high-volume threshold past which the inbox stops displaying and sending new messages, with warning banners shown in the conversation, and a moderation API that moves conversations to the spam folder or blocks users outright. A blocked or spam-filed user is unreachable in ways that surface as 551 or 200/1545041 on sends, and a business that users block en masse risks the account-level cutoff documented under 100/2534029.

These are the gates everything above sits behind, and most of them fail silently - no webhook events, empty account lists - rather than with an error code. The professional-account requirement and the Allow access to messages toggle are consumer-app settings invisible from the developer dashboard; when the toggle is revoked after connection, sends fail with 200/2534041. Development-mode and Standard Access restrictions produce the "works for admins, silent for customers" pattern behind code 200 and code 10. Choose one API route deliberately - permissions and tokens do not transfer between them.