Instagram Business Messaging: Access & Permissions

The first check is the account type. Meta describes Instagram professionals as Businesses and Creators in its Instagram API collection. Its Facebook Login path explicitly excludes consumer accounts. If an agency asks for API access to a personal profile, changing a Page role will not solve the account-type mismatch. Confirm the Instagram account is professional before assigning anyone or configuring a connector.

The next check is where messages are actually answered. Instagram has its own inbox; Meta Business Suite can bring Facebook and Instagram messages into one interface, as Meta describes for Business Suite. A person who can see a Page in one Meta tool may still lack the Instagram asset or its Messages task. Ask a new teammate to open the actual inbox and send a test reply before treating the handoff as complete. A screenshot of an invitation is weaker evidence than a successful reply from the intended account.

For an audit, write down three separate things: who can sign in as or administer the Instagram professional account, who has access to it through the business portfolio, and which apps have been authorized to use its messages. They are different routes to the same customer conversation. A departing agency might lose its portfolio assignment but still have an authorized integration. A founder might own the Instagram login but be unable to see the Page-linked connector in the expected portfolio. Review each route separately.

The Instagram API with Instagram Login lets a Business or Creator authorize an app for its professional account. Meta lists instagram_business_basic and instagram_business_manage_messages among its scopes, and notes that this setup cannot access ads or tagging in its Instagram Login reference collection. This path does not require a linked Facebook Page for the Instagram API. For example, a support vendor that needs DMs alone should explain why it requests any content publishing scope.

The Instagram API with Facebook Login starts from a professional Instagram account linked to a Facebook Page. Meta’s Facebook Login collection shows the Page requirement and a /me/accounts response containing Page tasks, the linked Instagram account and a Page access token. Meta’s Conversations API reference names the MESSAGING task on that linked Page, plus instagram_basic, instagram_manage_messages and pages_manage_metadata for Instagram conversations. Those are permissions for the Page-linked path, not substitutes for the Instagram Login scopes.

Record the path used by every connected tool. If a connector says it needs a Page token, look for the linked Page and the person or system user behind the token. If another asks the professional account to sign in directly, inspect its Instagram Login consent instead. Mixing the two troubleshooting guides is a common reason a team keeps re-linking a Page when the failing credential is an Instagram token. The distinction also matters during offboarding: removing Page access addresses the first route, whereas reviewing Instagram account authorization addresses the second.

As of November 2026, use the names displayed in the live Meta settings screen when you assign a person. Meta’s business-asset permissions distinguish Full control from Partial access for the Instagram account, with a separate Messages task. Check the Instagram asset assignment itself; Page tasks are listed separately. A publishing-only assignment should not be assumed to include DMs.

Use the table to review each Instagram inbox route: the person’s asset assignment, the linked Page task and the app grant. Review API grants separately because a token may continue serving conversations after a person stops working in Business Suite. For a two-person support team, give both responders the narrow message access the interface supports; reserve broad control for the business owner and a documented backup.

First choose the channel the person will actually use. A responder working in Business Suite needs access to the correct Instagram asset and its Messages capability. A developer configuring an API needs the authorization path and scopes, but may not need ongoing access to the inbox. Meta’s Business Suite introduction explains why the two channel inboxes can appear together; it does not make their permissions interchangeable.

In Meta Business Suite, a portfolio controller opens Settings > People > Invite people, then chooses the Instagram account as an asset and assigns Partial access > Messages for an ordinary responder (Meta invitation steps, asset permissions). If the account is not selectable, Meta’s instructions say to open Settings > Instagram accounts and log in to that Instagram account first. The invitee must accept the invitation; test a DM after acceptance. Do not ask an agency to sign in using the founder’s password to work around a missing assignment.

When someone changes jobs, go to Settings > People, select that person and use Manage beside the Instagram asset to change access or Remove access to end it (Meta change-access steps). Then check the linked Page and any app consent they established. A social editor moved to analytics should lose message access even if they keep an Insights task. For an external agency, have the business owner perform the change and watch a replacement responder receive a test DM before removing the old responder. That order keeps an active customer queue from becoming ownerless for a day.

Control of the Instagram professional account and control of a Meta business portfolio are related, but they are not the same artifact. Meta’s asset permissions say Full control of an Instagram account cannot be assigned to a partner business, so an agency handoff should leave that control with the client. Keep the login, recovery contact details and the asset assignment under the business’s control. If the only person who can approve a new connector leaves, a working inbox today can become impossible to reconnect tomorrow. Before the handoff, confirm a second trusted person can reach the right business settings and that the business can recover the Instagram sign-in.

Meta describes Accounts Center as the place for Personal details and Passwords and security across its apps. Use that account-level view when reviewing sign-in protections. Meta also recommends two-factor authentication, login alerts and session review for people with access to business tools. The useful test is specific: can the owner identify an unfamiliar session and remove access without relying on an agency employee’s phone?

A badge or business-verification status should be checked separately from message authorization. The Instagram API collection states the professional-account and token prerequisites; its Page-linked Conversations API description also calls for a verified business for that integration. A visible badge is not a Messages task, and a role assignment is not proof that an app has passed the access review it needs. Keep these checks as separate rows on a setup worksheet.

A token is the app’s authority to call an API; it is not an employee seat. In the Page-linked flow, Meta’s token example shows a Page access token acting for a Page linked to an Instagram profile. In the direct flow, the professional account authorizes the Instagram scopes. Log the app name, its owner, the path, the granted scopes and the date you tested a reply. This gives the next developer a concrete map when a connector stops receiving events.

The Instagram Send API is a customer-reply surface, not a blank address book. Meta says the recipient must have messaged the professional account first, group messaging is unsupported, and inactive Requests-folder conversations older than 30 days are not returned by API calls in its Send API description. Example: if a customer says an old request vanished from an external inbox, check Requests in Instagram before assuming a support agent deleted it.

For revocation, remove the app’s authorization in the route that granted it and rotate any credential the supplier held. Then verify that its webhook or inbox access stops and that the replacement integration still receives a new test message. Removing a person from a portfolio is necessary for their human access, but it is not a substitute for inspecting a separately authorized app. A former vendor’s deployment may continue to have a credential even though their employee no longer appears under People.

Use one account inventory with four columns: personal sign-in holders, business asset assignments, Page-linked integrations and direct Instagram Login integrations. Meta warns that attackers often target the personal accounts of people connected to business assets, then use those accounts to reach business tools in its business malware guidance. This makes the security of an agency employee’s personal sign-in part of the business’s DM risk, even when the brand itself has strong passwords.

For each departing person, check recent account sessions and login alerts, remove their Instagram and Page assignments, review any apps they introduced, and rotate shared secrets. Check the inbox’s Primary and Requests folders for unanswered customer messages. Meta’s Instagram inbox description distinguishes followers’ new conversations from non-followers’ Requests. A handoff that tests only a follower DM can miss an entire queue of new enquiries.

Document who will respond during the transition. If automation and human agents share the conversation, test the handoff with a real message and identify the owner of the resulting reply. Do not assume a new app will bring every historic conversation into view; the Requests-folder API limitation is a concrete counterexample. Retain the business’s own record of unresolved issues so a token rotation does not erase the team’s working context.

The wrong account type: a founder hands a developer a personal Instagram profile and asks for an API integration. Meta limits the Instagram API paths described here to professional accounts; convert and re-check before debugging token code (Instagram API). The wrong asset: an agency receives access to the Facebook Page but cannot answer Instagram Requests. Inspect the Instagram assignment and the actual Messages task, then send a non-follower test DM.

The wrong token family: a developer follows Page-token instructions for an Instagram Login connection. The direct path asks for instagram_business_manage_messages; the Page-linked path uses a Page access token and different permissions (Instagram Login, Conversations API). The old vendor’s app: the team removes an agency member but does not review the app they connected. Treat people and app grants as two checks.

The missing Requests queue: a new inbox looks empty, so the team declares a customer issue resolved. Meta documents distinct Primary and Requests behavior and limits API retrieval of older inactive requests. Check Instagram itself before closing the ticket. The single recoverer: one employee holds the only usable account recovery route. Put a trusted backup in place while the current owner can still approve the change. A badge cannot replace a working recovery route or the right message assignment.