PB-024: A Free Alternative to ManyChat

Step 4. Create the Meta app. At developers.facebook.com/apps, choose type Business and use case Manage messaging and content on Instagram. Do not pick Facebook Login, which breaks OAuth later with a mismatched-client error. Do not pick the Marketing API, which brings review requirements heavy enough to block publishing.

Step 5. Collect the three secrets. INSTAGRAM_APP_ID and INSTAGRAM_APP_SECRET live under the Instagram product's API setup page. FACEBOOK_APP_SECRET lives under App settings, Basic. Note that the Instagram app ID is deliberately not the same number as the Facebook app ID on the Basic page. Set all three. The app verifies webhook signatures against both secrets so you never have to guess which one Meta signed with.

Step 6. Tester invite, both halves. In the Meta dashboard under App roles, add your Instagram username as an Instagram tester. Then open the Instagram app as that account and go to Settings and activity, Apps and websites, Tester invites, and accept. Both halves are required.

Step 7. OAuth redirect. In the Instagram product's business login settings, register exactly https://your-app.vercel.app/api/instagram/callback. No trailing slash.

Step 8. Webhook. Callback URL https://your-app.vercel.app/api/webhook, verify token matching your environment value, then subscribe to the comments field. If the Verify button greys out, re-paste the token, since editing the URL clears it. Test delivery with the console's Test, Send to My Server. It takes two clicks. The first only previews.

Step 9. Publish the app. Set the privacy, terms, and data-deletion URLs. OpenReply serves them at /privacy, /terms, and /data-deletion on your own domain. Then publish.

Step 10. Test end to end. Connect the account under Settings, Connect Instagram. Create a campaign with a keyword. Then comment that keyword from a different account, because your own comments are ignored by design.

---

The shortcut

The repo ships a ready-made prompt in its "Set it up with an AI assistant" section. Clone the repo, open it in Claude Code, paste the prompt, and it drives the entire deploy while asking you for values as it goes.

This is the intended path, not a workaround. The repo's own guide recommends it.

One security note worth taking seriously: the assistant will need your real secrets to finish, including your Meta app secrets and your database URLs. Only paste those into tools you trust, and rotate them afterward.

---

The seven steps that fail silently

This is the part every setup guide skips, and it is the reason most people conclude the tool does not work.

None of these throw a useful error. The deploy succeeds, the dashboard loads, and nothing happens.

1. The app is still in Development mode. This is the single most common reason for "I set everything up and nothing happens." In Development mode, real comment webhooks are never delivered. Only the console's test button works, which is exactly why people think they verified it. Publish the app.
2. The tester invite was only half accepted. Adding yourself as a tester in the Meta dashboard is one half. Accepting inside the Instagram app is the other. Skip the accept and login fails with "Insufficient Developer Role."

3. ENCRYPTION_KEY does not match across both services. The web app encrypts the Instagram token. The worker decrypts it. If the key is not identical on Vercel and Railway, every single send fails while everything else looks healthy.

1. Vercel got the internal Railway URLs. Internal *.railway.internal URLs work between Railway services and hang from anywhere else. The worker wants internal. Vercel wants public.
2. Resend has an API key but no verified sender domain. Login is magic links only. No verified domain means no email, which means no login, for anyone.
3. A trailing slash on the OAuth redirect. .../api/instagram/callback/ and .../api/instagram/callback are different URLs to Meta. Connecting fails with a redirect_uri mismatch.
4. You tested from your own account. Your own comments are ignored by design. Use a second account or the automation will never fire no matter how correct the rest of it is.

Seven failure modes. Six of them are configuration and one is a testing mistake, and between them they account for nearly every "it just doesn't work" report.

---

What it actually does, ranked by leverage

Most feature lists are flat. Here is the leverage-ordered version.

1. Keyword to DM with no contact ceiling. Set a keyword on a post. Everyone who comments it gets your link in seconds. This is the entire product and the entire reason to leave a subscription tool. The economics stop working against you the moment a reel performs.
2. Tracked links. Swap in a tracked link and you can see exactly who clicked, not just who was sent. This turns the mechanic from a delivery tool into an attribution tool, which is the difference between "the reel got views" and "the reel produced pipeline."
3. Multiple accounts from one dashboard. Run several Instagram accounts through a single deployment. On a per-seat subscription this is where the bill compounds fastest.
4. Team access. Your editor or VA can set up campaigns without you handing over the Instagram login.
5. You hold the token. Self-hosting means your Instagram access token lives in your database, encrypted with your key, not in a vendor's. If the vendor changes pricing, gets acquired, or shuts down, nothing happens to you.
6. A health endpoint that tells the truth. /api/health reports database, Redis, queue, and worker heartbeat. A worker.healthy: false means no DM will ever send even while webhooks are arriving normally. This one endpoint replaces most debugging.

Six things. The first one is why you switch. The last one is why you stay, because self-hosted tools live or die on whether you can tell what broke.

---

Honest limits

This is a developer tool. You are deploying two services, configuring a Meta app, and managing environment variables. The afternoon is real, but it is a technical afternoon.

You own the uptime. Nobody is on call. If the worker dies, the DMs stop, and you find out from your comments section unless you check the health endpoint.

It is unofficial automation on someone else's platform. It uses Meta's sanctioned webhook and messaging APIs, which is the right way to do it, but Instagram's policies and API versions change and you are the one who has to keep up.

App Review is not required for you, and is required for a hosted version. Running it for your own account or a handful of testers never requires Meta App Review. If you want strangers to sign up to your instance, that is a different product, and it brings business verification and a screencast with it.

Local development needs a tunnel. Meta's webhooks cannot reach your machine directly. Run ngrok http 3000 and point NEXTAUTH_URL and both Meta URLs at the tunnel URL.

---

If something goes wrong

Webhooks arrive but no DM sends. Hit /api/health. If worker.healthy is false, the worker is down or misconfigured and nothing will ever send. If it is true, check that ENCRYPTION_KEY is byte-identical on Vercel and Railway.

"Insufficient Developer Role" on login. The tester invite was never accepted inside the Instagram app. Go to Settings and activity, Apps and websites, Tester invites.

The console test works but real comments do nothing. The app is still in Development mode. Publish it.

redirect_uri mismatch when connecting Instagram. Check for a trailing slash on the registered callback URL.

Nobody can log in, including you. Resend has no verified sender domain.

The Verify button on the webhook greys out. Re-paste the verify token. Editing the callback URL clears it.

Vercel requests hang or time out. You gave it the internal Railway URLs. Swap to public.

The build fails on Railway. The build command is still the default. Set it to npm run db:generate and the start command to npm run worker.

---

What this changes

Comment-to-DM was never a hard technical problem. It is a webhook, a keyword match, and a message send. The reason it costs sixty nine dollars a month is that the tooling got there before the alternatives did, and the pricing model quietly aligned itself against the thing you actually want, which is a post that reaches a lot of people.

A seventeen year old looked at that bill, decided it was not worth paying, and published the replacement for free.

The tradeoff is honest. You take on an afternoon of setup and the responsibility for your own uptime, and in exchange the cost stops scaling with your reach and the token stays yours. For anyone posting consistently, that trade pays for itself in the first month and keeps paying every month after.

The creators who own this layer instead of renting it are going to run the same mechanic at ten times the volume for the same few dollars.

---

Credit: OpenReply is built and maintained by Diwen (@diwenne on GitHub). Check the repo for current license terms before building anything commercial on top of it.