What is an Instagram-scoped ID (IGSID)?

When someone messages a professional account, Meta sends a webhook notification to the app connected to it. The notification carries the sender’s IGSID and their message, along with the ID of the account that received it, which Meta’s documentation writes as IG_ID. To answer, the app sends a POST request to /<IG_ID>/messages with the IGSID as the recipient.

A comment-to-DM flow uses two of these in turn. The first DM is a private reply addressed to the comment ID. When the person writes back, their reply arrives with an IGSID, and every later message in the conversation goes to that ID.

Given an IGSID, an app can ask Meta for that person’s profile. The fields on offer are name, username, profile_pic, follower_count, is_verified_user, is_user_follow_business and is_business_follow_user. The last two say whether they follow the business and whether the business follows them.

• The person has to reach out first, by sending a message, tapping an ice breaker or choosing from the persistent menu. Until then, Meta answers the lookup with an error saying user consent is required.
• name and profile_pic come back empty for people who haven’t set them, so a greeting needs a fallback such as “Hi there”.
• The profile_pic link stops working after a few days. Save the image itself if you need it later, not the link.
• If the person has blocked the business, none of their details can be read.

• Make the IGSID, not the username, the key for a contact. Handles change; the ID stays put, so chat history and a person’s place in a flow survive a rename.
• Keep it next to the account that received the message. Meta’s documentation describes the IGSID in the context of messages to a particular professional account, so a business running two accounts should keep their contact lists apart rather than merging on the ID.
• Store it as a string. Meta sends IDs as text, and converting a long ID to a number can quietly alter its final digits in spreadsheets and in languages such as JavaScript.
• Remember the window. An IGSID tells an app who to message, not when: replies have to go out within 24 hours of the person’s last message, each with no more than 1,000 bytes of UTF-8 text.