Connect Instagram (9 steps)

In the panel: Settings → Instagram card. The guide inside the card has these same steps, with copy buttons, direct links to your own app's pages and automatic ticks for the steps the app checks by itself. At the top of the card a three-state strip “Keys valid → Webhook verified → First message received” shows where you are, and writes the reason in red when something is stuck.

1. First set the “Public address” card to a fixed address (a Cloudflare tunnel on your own domain, or ngrok with a free fixed domain).What you see: A green “Public address” card whose address does not contain trycloudflare.⚠️ Common mistake: Staying on the “temporary” address: Meta keeps the old addresses and messages stop after every restart.
2. Create app → app name → use case “Manage messaging & content on Instagram” (for WhatsApp also tick “Connect with customers through WhatsApp”) → your business portfolio → Create app. Then paste the browser's address into the “Meta app” box.What you see: The list of use cases, then the new app's dashboard.⚠️ Common mistake: Making several apps, signing in with a new Facebook account or with a VPN on — the account may get blocked.
3. App settings → Basic: paste the “App secret” (Show) into the “Meta app” box; also paste the “Privacy policy URL” and “User data deletion” below there and click “Save changes”.What you see: “App ID” and “App secret” at the top, and the Privacy policy URL and User data deletion boxes.⚠️ Common mistake: This is the main App secret, not the Instagram app secret (that one comes next).
4. Use cases → “Manage messaging & content on Instagram” → Customize → “API setup with Instagram login”: under “Add required messaging permissions” click “Add all required permissions”; then paste the “Instagram app ID” and “Instagram app secret” into this card and “Save & test”.What you see: A page with 5 steps; the “Instagram app ID” and “Instagram app secret” (Show) at the top.⚠️ Common mistake: Pasting the Meta App ID / App secret here — the app warns when they match.
5. On the same page, “Set up Instagram business login” → “Business login settings”: paste the three addresses below into “OAuth redirect URIs”, “Deauthorize callback URL” and “Data deletion request URL”, then Save.What you see: The Business login settings window with three address boxes.⚠️ Common mistake: An extra “/” at the end of the address, or the old temporary address.
6. The app does this step itself (with the “Meta app” box): Callback URL, Verify token and the messages, messaging_postbacks and comments fields. Only if it reports an error, paste the rows below into “Configure webhooks”, click “Verify and save” and Subscribe.What you see: Under “Configure webhooks” Meta says “To receive webhooks, your app must be in published state”.⚠️ Common mistake: “Verify and save” is refused with a temporary address or while the app is off.
7. App roles → Roles → Add People → Instagram Tester → the page's username; then on instagram.com: Settings → Website permissions → Apps and websites → Tester invites → Accept.What you see: A pending invite until you accept it on Instagram.⚠️ Common mistake: Inviting a personal account, or forgetting Accept on instagram.com (without it “Log in with Instagram” fails).
8. Click “Log in with Instagram” in this card and sign in with the page's professional account; then on the phone: Settings → Messages and story replies → Message requests → Connected tools → turn on Allow access to messages.What you see: Instagram's login page (on free ngrok first “Visit Site”), then “Instagram connected”.⚠️ Common mistake: A personal account (switch it to Business or Creator first), or another Instagram account logged in in the same browser.
9. The app's Publish page → Publish. Then send the page a DM from another phone and click “I sent a test message”.What you see: The Publish button, then the “Published” state.⚠️ Common mistake: Without Publish Meta sends no message. Before App Review only accounts with a role in the app work.

The shared “Meta app” box (for Instagram and WhatsApp)

One Meta app is enough for both channels. Enter the Meta App ID and the main App secret (App settings → Basic) once in the Meta app card. The app uses them to check WhatsApp's message signatures, registers the Instagram and WhatsApp webhooks at Meta by itself (POST /subscriptions) and updates them whenever the public address changes. It is not the Instagram app secret — that one is on the “API setup with Instagram login” page and goes in the Instagram card.

1. Open the app (or create it) and paste the browser's address into the “Meta App ID” box; the ID is taken from it by itself.What you see: An address like developers.facebook.com/apps/1234…/ and the “App ID” at the top of the page.⚠️ Common mistake: Making a second app or signing in with a new Facebook account; keep the one app for both channels.
2. In App settings → Basic click Show next to “App secret”, copy it into the “Main App secret” box and click “Save & test”.What you see: “App ID” and “App secret” (with the Show button) at the top of the Basic page.⚠️ Common mistake: This is not the Instagram app secret — that one is on the “API setup with Instagram login” page and goes in the Instagram card.
3. On the same page paste the “Privacy policy URL” and “User data deletion” from the rows below, pick a “Category” and add a 1024×1024 “App icon”, then “Save changes”.What you see: The Privacy policy URL, User data deletion, Category and App icon boxes.⚠️ Common mistake: Without these the Publish button does not work; the icon must not show the Meta or Instagram logo.