Connect Instagram Direct to ConveRact, step by step

Use an Instagram professional account owned by the client. Personal accounts are not suitable for the production messaging integration. Keep the Instagram account, Meta app, token owner, and ConveRact tenant under the same documented business owner so credentials can be rotated without losing control.

For initial development, add the people who will test as app roles or approved testers. Before serving customers who are not app roles, complete every permission and review requirement shown in the Meta app dashboard.

ConveRact manual setup needs the Instagram professional account ID, an access token authorized for that account, and the Meta app secret. The account ID is a provider identifier, not the @username. Never paste an app secret or long-lived token into website code, a support ticket, or a public document.

Use the permissions and token flow shown for the Instagram login configuration selected in your Meta app. After generating the token, verify the account returned by Meta before saving it in ConveRact.

Sign in to the correct tenant as Tenant Admin. Open Channels, choose Instagram Direct, and create a live connection. ConveRact encrypts the provider token and app secret and does not return their raw values after saving.

The Meta channels feature requires the Growth plan or above. A demo connection is useful for interface review, but it does not prove that real Instagram messages can be delivered.

The ConveRact API must be reachable on a public HTTPS URL. Meta sends the verification challenge to that URL, followed by signed messaging events. ConveRact checks the verify token and x-hub-signature-256 before accepting live traffic.

Subscribe only the fields needed by the integration, including messages and messaging postbacks. A verified callback is not a complete test; a real DM from a separate account must reach the correct tenant and receive a reply.

Complete the permission review, business verification, data-handling declarations, privacy-policy URL, deletion instructions, and any screencast requested by the Meta dashboard. The exact review list depends on the products and permissions enabled in the app, so treat the dashboard as authoritative.

Before launch, test unsupported media, deleted messages, expired tokens, duplicate webhooks, unavailable catalog data, customer requests for a human, opt-outs, and provider outages. Monitor connection health after any Meta app or account change.