How to Automate Instagram Comment Moderation using the API

Understanding the Instagram Comment Moderation API

Setting Up Instagram Comment Moderation Authentication

Comment moderation requires the instagram_business_manage_comments scope, which must be separately approved through Meta App Review. This is distinct from the content publishing scope — even if you have publishing approved, you need a separate review for moderation. During development, add test accounts in App Dashboard > Roles > Test Users.

1. 1Create or use an existing Business App at developers.facebook.com
2. 2Add Instagram product if not already added
3. 3In App Review > Permissions and Features, request instagram_business_basic and instagram_business_manage_comments
4. 4For the review, prepare a screencast demonstrating your comment moderation use case (keyword filtering, spam detection, etc.)
5. 5Implement OAuth redirect: https://www.facebook.com/v25.0/dialog/oauth?client_id={app-id}&redirect_uri={uri}&scope=instagram_business_basic,instagram_business_manage_comments
6. 6Exchange authorization code for short-lived token at https://graph.facebook.com/v25.0/oauth/access_token
7. 7Exchange for 60-day long-lived token: GET https://graph.instagram.com/access_token?grant_type=fb_exchange_token&client_id={app-id}&client_secret={secret}&fb_exchange_token={short-token}
8. 8Store token and set up refresh job to run every 50 days

1import requests
2import os
3
4IG_USER_ID = os.environ['IG_USER_ID']
5ACCESS_TOKEN = os.environ['IG_ACCESS_TOKEN']
6
7def verify_moderation_access():
8    """Verify comment moderation permissions are active."""
9    # Try to list comments on a recent post to verify access
10    # First get a recent post
11    resp = requests.get(
12        f'https://graph.instagram.com/v25.0/{IG_USER_ID}/media',
13        params={'fields': 'id', 'limit': 1, 'access_token': ACCESS_TOKEN}
14    )
15    resp.raise_for_status()
16    posts = resp.json().get('data', [])
17    if not posts:
18        print('No posts found to test with')
19        return
20    media_id = posts[0]['id']
21    comments_resp = requests.get(
22        f'https://graph.instagram.com/v25.0/{media_id}/comments',
23        params={'fields': 'id,text', 'access_token': ACCESS_TOKEN}
24    )
25    if comments_resp.status_code == 403:
26        raise PermissionError(
27            'Missing instagram_business_manage_comments scope. Submit App Review.'
28        )
29    comments_resp.raise_for_status()
30    print(f'Comment moderation access confirmed. Found {len(comments_resp.json().get("data", []))} comments on test post.')
31
32verify_moderation_access()

Key endpoints

1{"data": [{"id": "17858893269000001", "text": "Great post!", "username": "user123", "timestamp": "2026-05-07T10:30:00+0000"}, {"id": "17858893269000002", "text": "Spam comment buy now!!!", "username": "spammer99"}], "paging": {"cursors": {"after": "abc123"}}}

1{"hidden": true, "access_token": "EAAB..."}

1{"success": true}

1{"success": true}

1{"message": "Thanks for your comment!", "access_token": "EAAB..."}

1{"id": "17858893269000003"}

Step-by-step automation

1curl -s "https://graph.instagram.com/v25.0/${IG_USER_ID}/media?fields=id,timestamp,comments_count&limit=20&access_token=${ACCESS_TOKEN}"

1curl -s "https://graph.instagram.com/v25.0/${MEDIA_ID}/comments?fields=id,text,username,timestamp&limit=50&access_token=${ACCESS_TOKEN}"

1# Hide a comment
2curl -X POST \
3  "https://graph.instagram.com/v25.0/${COMMENT_ID}?hidden=true&access_token=${ACCESS_TOKEN}"
4
5# Delete a comment
6curl -X DELETE \
7  "https://graph.instagram.com/v25.0/${COMMENT_ID}?access_token=${ACCESS_TOKEN}"
8
9# Reply to a comment
10curl -X POST \
11  "https://graph.instagram.com/v25.0/${COMMENT_ID}/replies" \
12  -d "message=Thanks for your question!" \
13  -d "access_token=${ACCESS_TOKEN}"

Complete working code

Complete comment moderation bot: fetches recent posts, polls for new comments since last run, classifies them using keyword and URL detection rules, executes moderation actions, and logs all decisions. Runs as a cron job every 15 minutes.

1#!/usr/bin/env python3
2"""Instagram Comment Moderation Bot - runs every 15 minutes via cron."""
3import os
4import re
5import time
6import json
7import logging
8import requests
9from datetime import datetime, timedelta, timezone
10
11logging.basicConfig(level=logging.INFO, format='%(asctime)s %(levelname)s %(message)s')
12log = logging.getLogger(__name__)
13
14IG_USER_ID = os.environ['IG_USER_ID']
15ACCESS_TOKEN = os.environ['IG_ACCESS_TOKEN']
16STATE_FILE = '/tmp/ig_moderation_state.json'
17BASE = 'https://graph.instagram.com/v25.0'
18
19BLOCKLIST = ['spam', 'buy now', 'dm me', 'follow for follow', 'click link', 'free money', 'earn from home']
20URL_RE = re.compile(r'https?://|bit\.ly|t\.me|wa\.me', re.I)
21
22def ig_get(path, params):
23    params['access_token'] = ACCESS_TOKEN
24    r = requests.get(f'{BASE}{path}', params=params, timeout=30)
25    r.raise_for_status()
26    return r.json()
27
28def load_state():
29    try:
30        with open(STATE_FILE) as f:
31            return json.load(f)
32    except FileNotFoundError:
33        return {'processed_ids': [], 'last_run': None}
34
35def save_state(state):
36    with open(STATE_FILE, 'w') as f:
37        json.dump(state, f)
38
39def get_recent_posts():
40    data = ig_get(f'/{IG_USER_ID}/media', {'fields': 'id,timestamp,comments_count', 'limit': 20})
41    cutoff = datetime.now(timezone.utc) - timedelta(days=14)
42    posts = [p for p in data['data'] if datetime.fromisoformat(p['timestamp'].replace('Z', '+00:00')) > cutoff]
43    return sorted(posts, key=lambda p: p.get('comments_count', 0), reverse=True)[:10]
44
45def classify(text):
46    lower = text.lower()
47    if URL_RE.search(text) and any(k in lower for k in BLOCKLIST):
48        return 'delete'
49    if any(k in lower for k in BLOCKLIST):
50        return 'hide'
51    return 'ok'
52
53def moderate():
54    state = load_state()
55    processed = set(state.get('processed_ids', []))
56    posts = get_recent_posts()
57    total_actions = 0
58    for post in posts:
59        comments_data = ig_get(f'/{post["id"]}/comments', {'fields': 'id,text,username', 'limit': 50})
60        for comment in comments_data.get('data', []):
61            if comment['id'] in processed:
62                continue
63            processed.add(comment['id'])
64            action = classify(comment.get('text', ''))
65            if action == 'hide':
66                try:
67                    requests.post(f'{BASE}/{comment["id"]}', params={'hidden': 'true', 'access_token': ACCESS_TOKEN}, timeout=10)
68                    log.info(f'Hidden comment {comment["id"]} from @{comment["username"]}')
69                    total_actions += 1
70                except Exception as e:
71                    log.error(f'Hide failed: {e}')
72            elif action == 'delete':
73                try:
74                    requests.delete(f'{BASE}/{comment["id"]}', params={'access_token': ACCESS_TOKEN}, timeout=10)
75                    log.info(f'Deleted comment {comment["id"]} from @{comment["username"]}')
76                    total_actions += 1
77                except Exception as e:
78                    log.error(f'Delete failed: {e}')
79            time.sleep(0.3)
80        time.sleep(0.5)  # Between posts
81    # Keep only last 10k IDs to prevent state file bloat
82    state['processed_ids'] = list(processed)[-10000:]
83    state['last_run'] = datetime.now(timezone.utc).isoformat()
84    save_state(state)
85    log.info(f'Run complete: {total_actions} actions taken')
86    return total_actions
87
88if __name__ == '__main__':
89    moderate()

Error handling

Rate Limits for Instagram Comment Moderation API

1import time
2import requests
3
4def safe_moderation_call(method, url, max_retries=3, **kwargs):
5    for attempt in range(max_retries):
6        r = getattr(requests, method)(url, timeout=20, **kwargs)
7        if r.status_code == 400:
8            code = r.json().get('error', {}).get('code')
9            if code in (17, 4, 32):
10                wait = 60 * (2 ** attempt)
11                print(f'Rate limited. Waiting {wait}s')
12                time.sleep(wait)
13                continue
14            if code == 100:  # Comment deleted by user
15                return None
16        return r
17    raise Exception('Rate limit retries exceeded')

• Budget your 200 calls/hour: 10 posts × 1 comment fetch = 10 calls; remaining 190 calls = budget for up to 190 moderation actions per hour
• Use a processed comment ID cache to avoid re-fetching and re-classifying the same comments on every run
• Poll recent posts (last 7 days) more frequently than older posts — most toxic comments arrive within hours of posting
• Add 300-500ms delays between each moderation action (hide/delete/reply) to avoid triggering secondary rate limits
• Log all moderation actions to a database to build a training dataset for improving your keyword filters over time

Security checklist

Automation use cases

No-code alternatives

Don't want to write code? These platforms can automate the same workflows visually.

Best practices

• Prefer hiding over deleting for borderline content — hidden comments can be reviewed and unhidden, while deleted comments are permanent
• Build a state file or database tracking processed comment IDs to prevent re-processing the same comments on every polling run
• Never make fully automated permanent deletions on high-confidence-only content — even the best keyword filters produce false positives
• Poll recent posts (published in last 48 hours) every 5-10 minutes; poll older posts much less frequently (hourly or less) to stay within rate limits
• Log all moderation actions with the original comment text, applied rule, and timestamp — this creates a training dataset for improving rules
• Set up a human review queue for comments that score borderline on your classifier, rather than making automated decisions on uncertain cases
• Test your blocklist and rules against historical comment data before deploying to avoid accidentally hiding legitimate comments at launch

Ask AI to help

Copy one of these prompts to get a personalized, working implementation.

Related automations

Explore related guides

Guides from other topics that help with this issue