# Comment to DM Delivery: keyword opt-in, one private reply, owner-approved copy

> Someone comments your keyword on an Instagram post and gets one private reply with the link they asked for, on Meta's official private reply path. A small Cloudflare Worker you own checks the signature, matches whole words against a register you approve, sends once per comment within Meta's 7-day window, honors STOP at once and starts paused.

- URL: https://paperchasewebb.ai/bots/marketplace/items/comment-to-dm-delivery-keyword-opt-in-one-private-reply-owner-approved/
- Type: Prompt pack
- Category: Solo business
- By: PaperChaseWebb
- Works with: Claude Code, Codex, Grok Bot, Hermes (named in the listing); A Cloudflare Worker in plain JavaScript, two Python scripts, and rules for AGENTS.md and CLAUDE.md, Claude Code and Codex notes, Hermes notes and a Grok Bot standing order. Tested against a fake Graph API; not run against a live Instagram account for this release
- Price: $29 USD
- Difficulty: Intermediate
- Setup time: 45 min
- Time to result: Tester mode in about 45 minutes; live after Meta App Review
- Format: Markdown (.md) file, comment-to-dm-delivery-keyword-opt-in-one-private-reply-owner-approved.md
- Version: 1.0, updated 2026-11-01
- License: Use for yourself, your team or your clients. Do not resell or republish the kit itself.

## What you end up with

Keyword requests on your posts answered once, with text you approved, and a log that shows every decision.

## What you get

- A Cloudflare Worker: signature check, whole-word keyword match, one private reply per comment, 7-day window, a conservative hourly cap you set, STOP opt-outs, paused by default
- An asset register template and register_check.py with 14 error checks and 2 warnings; it writes the worker's JSON only when clean
- log_review.py: weekly counts by code and keyword, lines a person must read, and a pause warning above 5% failed sends
- The governance table: every rule and the line of code that enforces it
- Meta App Review notes and a three-stage test protocol: tester mode, private test post, one live post
- AGENTS.md, CLAUDE.md, a Grok Bot standing order, Codex and Hermes notes and a comment-to-dm skill
- 20 tests you can run yourself

## Who it is for

Anyone who wants comment keyword delivery on their own worker, with rules they can point to.

## Tools needed

- Cloudflare Workers and Node 18 or newer: runs the worker and its tests; no npm packages
- Python 3.8 or newer: register check, log review and the dry run; standard library only
- Grok Bot, Claude Code, Codex or Hermes (optional): checks the register, runs the tests and reviews the log under AGENTS.md; never sends, approves copy, deploys or flips the kill switch
- You need: An Instagram professional account
- You need: A Meta developer app with the comments webhook (App Review for live use)
- You need: A Cloudflare account
- You need: Node 18 or newer and Python 3.8 or newer

Cost to run: The kit is the only purchase. You need a Meta developer app and a Cloudflare account; check Cloudflare's current free plan limits against your comment volume.

## How it works

1. **Run the tests.** Unpack the kit and run the Node and Python test suites. Expected: 10 worker tests and 11 Python runs pass.
2. **Deploy paused.** Create the KV store, set the three secrets and deploy the worker. PAUSED stays true. Expected: A worker that answers Meta's handshake and sends nothing.
3. **Approve the register.** Write the exact message per keyword, fill approved_by and approved_on, run register_check.py --emit. Expected: 0 errors, and register.json uploaded to KV.
4. **Test in three stages.** Tester mode, a private test post, then one live post for a week, flipping PAUSED back to true after each. Expected: One DM per keyword comment, S06 on a repeat, S08 on STOP.

## Sample prompt: Check my register (Grok Bot, Claude Code, Codex, Hermes)

```
Read AGENTS.md. Run python3 desk/register_check.py register.csv and explain each finding in one line. Suggest fixes, but do not change status, approved_by or approved_on.
```

Prompt 1 of 3.

## Sample prompt: Weekly review (Grok Bot, Claude Code, Codex, Hermes)

```
Run python3 desk/log_review.py logs.jsonl. Tell me sends by keyword, every line that needs a person, and whether it advised a pause. Do not change any settings.
```

Prompt 2 of 3.

## Sample prompt: Before a deploy (Grok Bot, Claude Code, Codex, Hermes)

```
Run both test suites and the register check and show me the counts. Do not deploy; I will.
```

Prompt 3 of 3.

## Free preview of comment-to-dm-delivery-keyword-opt-in-one-private-reply-owner-approved.md

````markdown
# Comment to DM Delivery with Approval Rules

**Someone comments a keyword on your Instagram post and gets one private reply with the thing they asked for. On Meta's official reply path, from a small worker you own, with a register you approve and a kill switch that starts off.**

Version 1.0, 2026-11-01. By PaperChaseWebb Inc. Works with Grok Bot, Claude Code, Codex and Hermes, or on its own.

## The problem

"Comment GUIDE and I will DM it to you" works because the person asked first. It goes wrong in three ways: a tool sends more than one message, it fires on words nobody meant as a request, or nobody can say who approved the text that went out. This kit keeps the good part and closes those three gaps.

## How it works

1. **Meta app with the comments webhook.** Meta sends your worker each new comment on your professional account.
2. **The worker checks the signature** (X-Hub-Signature-256 against your app secret). Anything unsigned is refused.
3. **The register decides.** A small table: keyword, which post (or every post), the link to deliver, the exact message text, who approved it, when, and live or paused. Only live, approved rows fire. A keyword matches as a whole word only.
4. **One private reply.** The worker sends one message on the private reply path (`POST /<IG_ACCOUNT_ID>/messages` with `recipient.comment_id`). Before sending it claims the comment, so a redelivered webhook cannot cause a second message.
5. **Every decision is logged** with a code, and you review
````

## Test record

- Date: Nov 1, 2026
- What was run: tests/worker.test.mjs (10) on Node 24 against an in-memory KV and a fake Graph API; tests/test_desk.py and tests/test_mini.py (11 runs) on Linux with Python 3.8, 3.9, 3.11, 3.12 and 3.13; files unpacked from the pack and tested fresh; wrangler deploy --dry-run bundle.
- Result: 10 passed and 11 passed, 0 failed on all five Python versions; each of the 14 register faults caught by its own code; bundle built.
- Not run: A live Instagram account or Meta App Review. macOS or Windows. A live Grok Bot, Claude Code, Codex or Hermes session.

Copied from this item's dated test notes. What was not run stays in.

## Worth knowing

- Live sending needs Meta App Review for your app, which can take weeks. Until then it works in development mode with tester accounts.
- Meta's private reply rules (one message per comment, within 7 days of the comment, follow-ups only after the person replies and within 24 hours of that reply) were read from Meta's documentation on 2026-11-01. Check them again before you go live. [Source: Meta Instagram Platform docs, private replies, checked Nov 1, 2026](https://developers.facebook.com/docs/instagram-platform/private-replies)
- Matching is by keyword, not meaning. Keep keywords specific.
- Tested with a fake Graph API and an in-memory store; not run against a live Instagram account for this release. Agent rules guide; they are not a lock.
- On 2026-11-01: 10 worker tests passed on Node 24, 11 Python test runs passed on Python 3.8, 3.9, 3.11, 3.12 and 3.13, and the worker bundled with wrangler deploy --dry-run.

## Questions

**Is this the official way to do it?** It uses Meta's private reply endpoint for comments, the path Meta documents for replying to a commenter by direct message. You still need your own Meta app and App Review.

**Can it send more than one message?** No. It claims each comment before sending, so even a redelivered webhook cannot cause a second reply. Follow-ups are written by a person, after the commenter replies.

**What if something breaks?** Set PAUSED to true and nothing sends. Errors are logged and never retried, and the commenter sees nothing.

**How is it different from the outreach and text consent kits?** Those cover reaching out first and text messages. This one only answers people who asked by commenting your keyword on Instagram.

## How to buy

$29 one time at https://paperchasewebb.ai/bots/marketplace/items/comment-to-dm-delivery-keyword-opt-in-one-private-reply-owner-approved/. Stripe checkout, then an instant download page; the download link is also in your emailed receipt.

Seller: PaperChaseWebb Inc., mgmt@paperchasewebb.com