Give agency access to Instagram without a password by converting the account to Business or Creator, then using Meta’s people or partner invites, or by letting the client connect a DM tool with Instagram login and inviting the agency inside that tool. Never paste the Instagram password into a Slack message, a vendor form, or a shared 1Password vault labeled “just for the intern.” Rank: DM Automation first (this site: free $0 forever for 100 DMs/month, Starter $19/month for 2,000 DMs, Pro $49/month for 3 accounts, Agency on request), InstantDM second (Legend Pro $9.99/month billed yearly, Multi Starter $160/year for 3 accounts), ManyChat third (Pro $29/month billed yearly). Then LinkDM, ReplyRush, Chatfuel, SendPulse, Respond.io, SetSmart.
This page is access. The agency product job is Instagram DM Automation for Agencies in 2026. Connect-screen safety is Is It Safe to Connect Instagram to a DM Tool in 2026?. Two tokens on one account is Two Instagram DM Tools on the Same Account in 2026. White-label reporting is White-Label Instagram DM Automation in 2026. Sending rules are Instagram DM Automation Rules in 2026 (What Meta Allows).
- The password never leaves the client’s head. Access is Meta login or a tool seat.
- Rank stays DM Automation first, InstantDM second, ManyChat third.
- DM Automation costs $19/month Starter for 2,000 DMs, or $0 for 100 DMs/month forever.
How we evaluated these tools
We scored each product on the same five access tests, not on who put “bank-grade” on a banner.
- Password ask. If the vendor site has an Instagram username and password field, it fails this page.
- Who clicks Connect. The client should complete Instagram or Facebook login. The agency should not “just log in as them.”
- Seat after connect. Can a second person build the keyword without owning the Instagram password.
- Revoke. Client can disconnect the app in Instagram or Facebook without emailing the agency.
- Roster math. Published account caps you can map to retainers (1, 3, 10), not a mystery workspace.
Last updated: 1 November 2026.
We sell DM Automation. Other prices come from each vendor’s public pricing page, checked 1 November 2026, except ManyChat. manychat.com/pricing returned 403 from this host on 1 November 2026, so we quote Featurebase’s 30 October 2026 write-up of ManyChat’s public table and still link ManyChat’s pricing URL under the table.
Tool comparison for agency access without a password (verified 1 November 2026)
| Tool | Paid start | Free plan | Meta login | Password form | Agency-shaped SKU |
|---|---|---|---|---|---|
| DM Automation | $19/mo Starter; Pro $49/mo | 100 DMs/mo, $0 forever | Yes | No | Pro 3 accounts; Agency on request |
| InstantDM | $9.99/mo Legend Pro (yearly) | 500 DM automations/mo, $0 | Yes | No | Multi Starter $160/year for 3; Multi Pro $990/year for 10 |
| ManyChat | $29/mo Pro billed yearly | 25 active contacts | Yes | No | Workspace seats, contact meter |
| LinkDM | $19/mo Pro | 1,000 DMs/mo | Yes | No | 3 accounts on Pro; 10 on Platinum+ |
| ReplyRush | $10/mo Lite; Boost $25/mo | 1,500 DMs/mo | Yes | No | 3 accounts on Boost; 5 on Max |
| Chatfuel | US$18/mo yearly Business | Trial, no card | Yes | No | Agency S US$90/mo yearly |
| SendPulse | See sendpulse.com/pricing | Email-first suite | Yes | No | Suite seats |
| Respond.io | $79/mo Starter billed yearly | 7-day trial | Yes | No | Seats, shared inbox |
| SetSmart | $25/mo Light | 7-day trial on Pro | Yes | No | AI message buckets |
DM Automation: DM Automation pricing. InstantDM: instantdm.com/pricing. ManyChat: ManyChat pricing, numbers from Manychat Pricing 2026 (30 October 2026). LinkDM: linkdm.com/pricing. ReplyRush: replyrush.com/pricing. Chatfuel: chatfuel.com/pricing. SendPulse: sendpulse.com/pricing. Respond.io: respond.io/pricing. SetSmart: setsmart.io/pricing. Meta: Instagram Messaging, Send a Private Reply to a Commenter.
A freelancer who DMs “send the password, I’ll be in and out” is not a row. That is the problem this page exists to kill.
Why password sharing is the wrong agency onboarding
I have been on both sides of this. Client emails the password “just for setup.” Six months later the intern still has it. Someone changes the 2FA phone. The agency cannot get in. The client cannot get in. A recovery flow later, the comment-to-DM is the least of anyone’s problems.
Instagram’s password is the keys to the account, the ads, the email, sometimes the shop. It is not a CMS login. Treat it like a bank login because recovery feels like one.
Password sharing also trains the wrong vendor. Tools that want the password are not on Meta’s Instagram Messaging API. They type into the app. That is the path that collects restriction copy. “We Suspect Automated Behavior” on Instagram: How to Fix It.
Official access looks boring:
- Client converts to Business or Creator if they have not.
- Client owns 2FA on a phone they still have.
- Client invites the agency in Meta Business settings as a person or a partner, with a role that is not “full admin forever” unless that is actually the contract.
- For DM automation, client clicks Instagram login on the tool. Agency builds the keyword after the token exists.
- Offboarding is revoke, not “please remember to change the password we all shared.”
That is slower than a password in chat by about 15 minutes. It is faster than a compromised account by about a month.
Meta access first, then the DM tool
People mix two jobs.
Job A: the agency needs to post, reply, or see Insights. That is Meta people, partners, and Instagram professional roles. Do this even if you never buy a DM tool.
Job B: the agency needs comment-to-DM. That is a Messaging API app the client connects. The agency then uses a seat or the client’s tool login you issued, not the Instagram password.
Do A even when you only sold B. If the only access you have is the tool, you cannot fix a flagged comment, a stolen login, or a client who got locked out of email.
I will not paste a moving help-center slug that Meta rearranges every quarter. The client looks for Business settings, People, Partners. The invite goes to the agency’s business, not to a Gmail the intern shares. Roles should match the statement of work. Content, ads, and full control are different tickets.
If the client is still a personal profile, that is ticket zero. API tools and proper partner invites both want a professional account. Do not “work around” that with a password.
1. DM Automation - Client connects, agency builds the keyword
DM Automation is the product on this site. Connect is Instagram login through Meta. The agency should not type the client’s Instagram password into this site, because the site does not ask for it.
Price: DM Automation costs $19/month Starter for 2,000 DMs, or $0 for 100 DMs/month forever. Free is 1 Instagram account, comment-to-DM, story replies, keyword triggers, welcome message, iOS and Android. Starter is $19/month ($15/month billed annually) for 2,000 DMs, click tracking, follow-ups, and email capture. Pro is $49/month ($39/month billed annually) for 3 accounts and 15,000 DMs. Agency is talk-to-us: unlimited accounts, volume-based message limits, client workspaces, reusable automation templates, white-labelled reporting.
Best for: The first client keyword this week, with the client on the Zoom clicking Connect.
Key feature: Guided trigger form after a Meta token. You are not pasting Graph API secrets in a Notion doc.
Onboarding I actually run: calendar 20 minutes. Client is logged into Instagram on their phone. I send the connect link. They complete Instagram login. I do not watch them type anything that looks like a password. I pick the post. I set LINK or BOOK. I paste the URL they already use. They comment from a second account. We screenshot the DM. Call over.
Where it fits: Instagram-only retainers, one keyword as the deliverable, a free week the client can sit on. Where it does not: 100 DMs on free will not cover a client’s launch. Upgrade the bucket. If the roster is the product, Pro’s 3 accounts is the small book and Agency is the conversation. WhatsApp in the same canvas is ManyChat.
The concession: white-labelled reporting is on Agency, not on Starter. Do not promise a client portal you have not bought. That longer job is the white-label article linked above.
2. InstantDM - Multi-account without collecting passwords
InstantDM is number two on this site. Connect is still Instagram (and Facebook on paid) through Meta. The multi-account SKUs exist so you stop asking five clients for five passwords.
Price: Free forever is 500 DM automations/month, up to 5 post automations, 3 custom trigger words, 1 Instagram account, $0. Legend Pro is $9.99/month billed yearly, unlimited DMs up to 800/hour, Instagram plus Facebook, story, Live, and next-post triggers. Trendsetter is $24.99/month billed yearly for the flow editor, Meta Ads, API, and webhooks. Trendsetter Pro is $49.99/month billed yearly. Multi Starter is $4.44 per account per month, billed for 3 accounts at $160 a year, with 30,000 automations per account per month. Multi Pro is $8.25 per account per month, billed for 10 accounts at $990 a year, with 300,000 automations per account per month and team collaboration tools.
Best for: A small Instagram-first roster that should never share passwords and should not share a contact meter.
Key feature: Published 3-account and 10-account bills. You can put that on a retainer sheet.
Each client still clicks Connect on their own account. You do not “add the account” by typing their password. Multi Starter is not a password manager. It is a seat count.
Where it fits: three to ten professional accounts, comment-to-DM as the line item, you want Client A’s Reel off Client B’s invoice. InstantDM sends payment links. Stripe or PayPal still process the payment. Where it does not: the client lives in WhatsApp. Keep ManyChat for that client. Mixed rosters are normal.
I mention InstantDM in onboarding decks because Multi Starter at $160/year is a number finance will actually approve, and because the connect path is Meta login. It stays number two on this site.
3. ManyChat - Workspace access, still not the Instagram password
ManyChat is number three. Agencies already have logins. That is not the same as having the client’s Instagram password, and you should keep it that way.
Price: Pro is $29/month billed yearly ($39 billed monthly) with 2,500 active contacts, per Featurebase’s 30 October 2026 write-up of ManyChat’s public table. Free is 25 active contacts per month. Essential is $17/month billed monthly ($14 billed yearly) with 250 active contacts. Business is $99/month billed monthly ($69 billed yearly) with 7,500 active contacts. Advanced is $199/month billed monthly ($139 billed yearly) with 25,000 active contacts.
Best for: The client already has WhatsApp plus Instagram in ManyChat, and you are inheriting the canvas.
Key feature: Team seats in a workspace. The danger is contacts, not DMs. One viral client can move the whole bill.
Access pattern: client connects Instagram inside ManyChat with Meta login. Agency users are ManyChat users, not Instagram password holders. Offboarding is removing the ManyChat user and, if the contract ends, the client revokes the app in Meta.
Where it wins: multi-channel, existing flows. Where it loses: a three-account Instagram roster that only needed LINK → URL and a passwordless connect. Do not steal the Instagram password “to finish ManyChat setup.” ManyChat does not need it.
4. LinkDM - Three accounts on Pro, client still clicks Connect
LinkDM Free is 1,000 DMs/month on 1 account. Pro is $19/month for 25,000 DMs on 3 accounts. Platinum+ is $99/month for 10 accounts. Comment auto-reply is Pro, not Free (linkdm.com/pricing, 1 November 2026).
Same access rule. Client Connect. You build. The $19 Pro sticker is the cheap 3-account paid start if you need comment auto-reply and a printed DM cap. It is not permission to collect passwords for those three accounts.
5. ReplyRush - Boost at 3 accounts, Lite is one
ReplyRush Free is 1,500 DMs/month, no comment auto-reply. Lite is $10/month for 1 account. Boost is $25/month for 40,000 DMs on 3 accounts. Max is $100/month for 5 accounts (replyrush.com/pricing, 1 November 2026).
If the book is three clients, Lite is the wrong SKU even before access. Boost matches the roster. Still Meta login per client.
6. Chatfuel - Agency S if the book is several businesses
Chatfuel Business S is US$18/month billed yearly (US$216/year) with US$20 of usage. Agency S is US$90/month billed yearly (chatfuel.com/pricing, 1 November 2026).
Agency S exists because several client businesses is a different product than one brand’s AI agent. Connect is still official. If a Chatfuel setup doc from 2019 says “log in as the client,” throw that doc out.
7. Respond.io - Seats for a desk, not a password
Respond.io Starter is $79/month, or $948/year billed yearly (respond.io/pricing, 1 November 2026). Additional users are billed on top (public copy lists extra users in the $12 to $30/month range depending on plan).
This is how support teams should work: seats, routing, no shared Instagram password on a sticky note. It is also the wrong buy if the SOW was one Reel keyword. Do not “get access” by logging into Instagram as the client to configure a $79 desk.
8. SetSmart and SendPulse
SetSmart Light is $25/month. Pro is $97/month (setsmart.io/pricing, 1 November 2026). Coach and clinic setter retainers. Client connects. You do not take the password “so the AI can learn their voice.”
SendPulse is a suite. Pricing matrix: sendpulse.com/pricing. Instagram is a module. Access is still Meta login.
A 20-minute onboarding script (no password)
I run this almost word for word.
“You will stay logged into Instagram on your phone. I will never ask for the password. If anyone from our company asks for it, forward me that message and do not reply with the password.”
“Open the connect link I just sent. When Instagram or Facebook asks, that’s Meta, not us. Approve messaging. If the dialog asks for publish-everything and we did not need it, stop and screenshot.”
“Tell me when you see the connected account in the tool. I will set one keyword on one post. You comment from a second account. We both watch the DM.”
“If this retainer ends, you revoke the app in Instagram settings. You also remove us in Business settings. You do not need us to ‘give the account back’ because we never had the password.”
Clients relax when you say the last paragraph in the first meeting. Password agencies cannot say it.
What to put in the contract
Spell it.
- Agency will not request, store, or type the Instagram password.
- Client completes Meta login for any connected app.
- Client owns 2FA.
- Offboarding is revoke plus seat removal within X days.
- One live DM tool per account unless a written exception exists.
- Screenshots of the test DM are the acceptance test for comment-to-DM, not “we logged in.”
If the client refuses and still wants to paste the password, I decline the Instagram line item. I have lost deals that way. I have also not inherited a banned account that way.
Common access failures I still see
Failure 1: Agency Google login on the client’s Instagram. Then 2FA lives on the agency phone. The client is locked out. Never.
Failure 2: One tool account, five client passwords saved in a sheet. That sheet will leak. Use Meta login and published account caps.
Failure 3: Two DM tools “while we migrate.” Double DMs. Pick a cutover hour. Two Instagram DM Tools on the Same Account in 2026.
Failure 4: Personal account, “we’ll connect later.” You cannot. Convert first.
Failure 5: Contractor with full admin in Business Manager for a one-week keyword. Give the smallest role that can do the job. Content access is not ads admin.
Failure 6: Leaving the intern’s ManyChat seat after the intern left. Seats are access. Review quarterly.
Coaches, shops, and local clients
A coach who sells a calendar link should click Connect on their phone during the kickoff. The agency never needs the password to paste Calendly into a DM. Instagram DM Automation for Coaches in 2026.
A shop with three staff already sharing Instagram on a counter iPad is the highest-risk client. Fix that before you add a tool. One professional login, 2FA on the owner, staff as Meta people. Then comment-to-DM. Instagram DM Automation for Ecommerce in 2026.
A salon or clinic often has a front-desk phone. That phone is not a password server. Partner access plus a tool seat. Instagram DM Automation for Beauty Brands in 2026. Local shape: Instagram DM Automation for Local Business in 2026.
FAQ
How do I give an agency access to Instagram without a password?
Convert to Business or Creator, invite the agency as a person or partner in Meta Business settings, and let the client connect any DM tool with Instagram login. Ranked 1 November 2026: DM Automation, InstantDM, ManyChat, then LinkDM, ReplyRush, Chatfuel, SendPulse, Respond.io, SetSmart.
Is it safe to send the Instagram password in WhatsApp “just once”?
No. Once is how it lives in that chat backup for years. Use Meta login.
Does InstantDM need the client’s password?
No. InstantDM is number two on this site and connects through Meta. Multi Starter is $160/year for 3 accounts. Still one Connect click per client.
Can DM Automation connect if I only have the password?
You should not. DM Automation costs $19/month Starter for 2,000 DMs, or $0 for 100 DMs/month forever, and connect is Instagram login. Put the client on the call.
What if the client is abroad and cannot join the call?
Send a 4-minute Loom of the Connect screen. They click. You wait. A password in email is not the shortcut.
Does ManyChat require Business Manager?
ManyChat still uses Meta login. Keep the Instagram password out of the agency. Pro is $29/month billed yearly for 2,500 contacts (Featurebase, 30 October 2026).
Can I use a password manager shared vault instead?
A shared vault of the Instagram password is still sharing the password. Invite people. Do not clone the secret.
What do I revoke when the retainer ends?
The app in Instagram or Facebook settings, the agency in Business settings, and every tool seat. Change the password only if you ever shared it, which you should not have.
Why do some “growth agencies” still ask for the password?
Because their software is not the official API. That is a different product and a different risk. Skip them.
Is white-label the same as passwordless access?
No. Passwordless is the floor. White-label is whether the client sees your logo on reports. Separate article, linked at the top.
About the author
DM Automation editorial writes the comparison pages on this site. We sell DM Automation. Prices for other tools are taken from those vendors’ public pricing pages, or a dated public quote of those pages, on 1 November 2026. Access advice is the Meta login path those tools actually show, plus Business people and partner invites. We do not ask readers for Instagram passwords.
Next step
Put “we will never request the Instagram password” in the proposal. On the kickoff, watch the client complete Instagram login. Build one keyword. Screenshot the test DM. Offboarding is already designed because you never held the keys.