Two things share one name
Search for "Instagram automation" and you will find two completely different products described with the same words.
The first logs into your account with your username and password, then clicks around pretending to be you. It can follow, unfollow, like, comment and send messages, because as far as Instagram is concerned it is you.
The second never sees your password. It is connected through Meta's own API, with permissions you granted on Meta's own screen, and it can only do the specific things that API allows.
One of these is against Instagram's terms and regularly gets accounts restricted. The other is a documented, supported integration that Meta reviews before approving.
Knowing which one you are buying matters more than any feature comparison.
What the unofficial kind actually does
Tools that ask for your Instagram password work by automating a browser or by imitating the mobile app's private endpoints. Neither is a supported route.
The practical consequences:
- It looks like suspicious login activity. Your account signs in from a data centre in another country, at machine speed, doing things no thumb could do.
- It breaks the moment Instagram changes anything. Private endpoints are not promised to anyone, so they shift without notice.
- You have handed your password to a company you do not know. If they are breached, so are you — and if your Instagram password is reused anywhere else, so is that.
- The penalty lands on you, not on them. Action blocks, shadow restrictions and, at the end of the line, a disabled account.
The uncomfortable part is that it often works for a while. Accounts get restricted weeks or months in, which makes the cause hard to see.
What the official route allows
Meta publishes an API for exactly this purpose, and it is genuinely capable — within limits that are written down.
You can:
- Read comments on your posts, reels and live videos
- Reply to those comments publicly
- Send a direct message to someone who commented or messaged you
- Read and answer your inbox
- Read your own account's insights
You cannot:
- Message people who have not interacted with you
- Follow, unfollow or like on your behalf
- Read anybody else's private data
- Message someone more than 24 hours after their last interaction
That last one is not a tool limitation. It is the platform protecting people from being messaged by businesses they never contacted, and no tool can lift it.
The permissions, and what each one is for
When you connect an account properly, Meta shows you a consent screen listing what you are granting. It is worth reading rather than tapping through:
| Permission | What it lets a tool do |
|---|---|
instagram_business_basic | See the account's name, username and profile picture |
instagram_business_manage_messages | Read and send direct messages |
instagram_business_manage_comments | Read comments and reply to them |
instagram_business_manage_insights | Read the account's own statistics |
Four narrow permissions, each tied to a visible feature. If a tool wants your password instead, it is asking for all of them at once, plus everything else your account can do — with no list and no way to take part of it back.
You can revoke any of this from Instagram at any time, without contacting the tool.
How to tell which kind you are looking at
A few questions separate them quickly.
"Does it ask for my Instagram password?" If yes, stop. There is no version of the official route that needs it.
"Where do I sign in?" The official flow sends you to Instagram's own page — the address bar says instagram.com. If the login form lives on the tool's own site, it is not the official flow.
"Can I disconnect from Instagram's side?" Official connections appear in your Instagram settings under connected apps and can be revoked there. An unofficial one does not appear anywhere, because there is nothing to revoke — it is just a saved password.
"Does it offer auto-follow or auto-like?" The official API does not permit either. A tool advertising them is not using it.
"Does it need a business or creator account?" The official API only works with professional accounts. A tool that works on a personal account is not going through Meta.
What being restricted actually looks like
It is rarely a dramatic ban. More often:
- Comments you send stop appearing to anyone but you
- Direct messages say sent but never arrive
- Reach falls with no change in what you post
- A block on a specific action, "try again in 24 hours", that keeps returning
By the time these show up, the cause is weeks in the past, which is why the connection is so often missed. The account is not broken; it is being quietly held back.
Recovering means disconnecting the tool, changing the password, and waiting — sometimes a long time.
The trade you are making
The official route gives up some things. You cannot mass-follow. You cannot message a list of people who never contacted you. You cannot automate your way to an audience.
What you get instead is an integration that keeps working: it does not break when Instagram updates, it does not put the account at risk, and it does not depend on a password sitting in someone else's database.
For a business whose customers are on that account, that is not a small trade. It is the whole point.
Where Riplo sits
Riplo uses the official API and nothing else. The connection goes through Meta's own sign-in screen, the four permissions above are shown to you before you approve them, and your password is never requested, seen or stored.
That is also why Riplo will never offer auto-follow or auto-like — not as a product decision, but because the API does not permit it, and anything that did would be the other kind of tool.
If you want the detail on how the connection works, the comment-to-DM guide walks through the flow. Otherwise you can start free and see the consent screen for yourself before granting anything.