HushReply: free comment-to-DM for Instagram and Facebook

On Facebook and Instagram you post “Comment GUIDE and I’ll send it to you.” Someone comments GUIDE, and within a second they get a DM with the link, plus an optional “Check your DMs 📬” reply under their comment.

That is the one ManyChat feature most creators and businesses actually use. But ManyChat’s free plan now stops at 25 contacts, and one viral post can push you into a paid tier. HushReply does that one job, for free.

What it does

• Instagram and Facebook Pages from one deployment.
• Keyword rules that ignore the word inside other words and handle emoji, so LINK🙏 matches but linked doesn’t.
• Public replies with rotating variations, so it never looks copy-pasted.
• Multiple accounts, each with its own keywords.
• A simple dashboard: no code, and you can test a comment before it goes live.
• Honest replies: if the DM fails, the “check your DMs” reply is held back.

How it’s built

It runs as one small Worker in your own Cloudflare account, on the free plan, which covers about 500 keyword replies a day at $0. It uses Meta’s official private-replies API: no scraping, no browser automation and no password sharing. There is a one-click “Deploy to Cloudflare” button, and no Meta App Review is needed when you use it on your own accounts.

Under the hood

Each comment follows the same path through the Worker: webhook in, signature check, parse, find the account, find the rule, claim the comment, check the cooldown, send the DM, then post the public reply.

• Answer Meta first, work second. Meta retries any webhook that responds slowly, so the Worker returns 200 immediately and does the Graph API calls in ctx.waitUntil.
• Never DM twice. Every comment id is claimed in Workers KV before anything is sent, so a redelivered webhook is ignored. A self-comment guard checks against every configured account, so two of your accounts can never get stuck replying to each other.
• Signatures checked properly. HMAC-SHA256 against each app secret, because Instagram Login uses a different secret from the Facebook app.
• Emoji-aware matching. JavaScript’s \b only understands ASCII, so the word match mode uses a hand-written Unicode word boundary. Other modes are contains, exact, starts-with, regex and any comment.
• Stable replies. The public reply variation is picked from the comment id, so a retried webhook posts the same text.
• Tokens that don’t expire. A daily cron refreshes Instagram’s long-lived tokens before their 60-day expiry.
• Secrets stay out of `ps`. The local dashboard only listens on 127.0.0.1 and passes tokens to wrangler through stdin or a chmod 600 temp file, never as command-line arguments.

It ships with DRY_RUN on, and 82 unit tests run on Node’s built-in test runner.

HushReply is open source under AGPL-3.0. Try it from the website or read the code on GitHub.