How Agencies Run Instagram Automation Across Clients

Multi-account product basics: multi-account Instagram automation. This article is agency ops: access, naming, QA, reporting, and killing automations when the retainer ends — without mixing brands or keeping passwords you should never have. Official Graph API versus unofficial tools: official API vs unofficial tools.

Separate connections, naming, test accounts, and a kill switch when the contract ends. No Instagram passwords. Meta OAuth only. Test with a second account before a launch Reel — how to test comment-to-DM.

Never collect the Instagram password

Meta OAuth only. If a client offers the password in a spreadsheet, refuse. Unofficial login tools are a different, unsafe category. Your MSA should say who owns the Professional account, who can disconnect, and that the agency will not store IG passwords. When the retainer ends, disconnect is a checklist item, not a vibe.

Staff get workspace roles you can revoke. They do not get the client’s Instagram password “so they can hop in over the weekend.” If the client’s social lead leaves, re-auth — do not keep a personal login that walked out.

A naming pattern that survives a retainer

Name rules like client-acme / reel-launch-12-sep / LINK. When the retainer ends, you can find and pause that automation without reading every caption. Mix two clients in one rule and you will send Acme’s checkout on Bravo’s Friday Reel. Tags on contacts should include the client code. UTMs should include the client and the media, not a house default “agency-ig.”

• One Instagram connection per client account. Do not share a connection across two brands.
• One test IG per client or a dedicated QA account the contract allows.
• A pause list in the project board that matches rule names, not “the denim one.”
• A recap sheet: sends, queue, one outcome the client already believes (not a fake open rate).

QA per client before the launch Reel

Test with a second account on a throwaway keyword, then switch to the real word. Confirm Requests placement for non-followers if the client’s audience is cold. Confirm the public one-liner. Confirm the destination URL on staging if they have it. Do not test production CODE discounts on a public Reel “just to see.”

If the client sells regulated things (clinics, supplements, finance-adjacent), read their vertical article before you add a catch-all. Your job is not to be clever with keywords. Your job is not to get them a complaint. Clothing SIZE on the wrong SKU is on you if you scoped media lazily.

Offboarding

Pause automations, disconnect, remove staff, export whatever the contract says you may keep (usually not their audience DMs as a souvenir). Do not leave last month’s drop URL live. Do not keep a webhook “just in case they come back.” Do not transfer by sharing passwords. If they move in-house, walk their social lead through the connection on a call.

Kill switch when the contract ends is also a mid-retainer tool: a product recall, a legal letter, a creator scandal. Pause first, argue later. DM automation should be pausable by someone who is not on a flight.

Reporting without mixing brands

Separate dashboards or separate tabs. Acme’s queue depth is not Bravo’s. Do not screenshot CommentLink with another client’s handle visible. Weekly: connection health, dead media, one outcome. Same discipline as the weekly dashboard article, per client.

What you cannot promise in a pitch deck

Live comment triggers, Trial Reels modes, Broadcast Channel posting, Click-to-DM ads management, Shopify catalog messaging, HubSpot/Salesforce native sync, Meta Business Agent, silent comment-to-WhatsApp. If a client asks, say no and sell official comment-to-DM, Story reply rules, a shared inbox, and a queue. That is enough for most retainers. Lying in the pitch is how you spend the retainer on refunds.

The spreadsheet with the Instagram password is a refuse, not a kickoff

Meta OAuth only. If a client offers the password in a Notion table, refuse. Unofficial login tools are a different, unsafe category. Your MSA should say who owns the Professional account, who can disconnect, and that the agency will not store IG passwords. Staff get workspace roles you can revoke. They do not get the client’s Instagram password “so they can hop in over the weekend.” If the client’s social lead leaves, re-auth — do not keep a personal login that walked out.

One Instagram connection per client account. Do not share a connection across two brands. Mix two clients in one rule and you will send Acme’s checkout on Bravo’s Friday Reel. Tags include the client code. UTMs include the client and the media, not a house default “agency-ig.”

Naming, QA, and the throwaway keyword before the launch Reel

Rules named client-acme / reel-launch-12-sep / LINK. When the retainer ends you can find and pause without reading every caption. Test with a second account on a throwaway keyword, then switch to the real word. Confirm Requests placement for cold audiences. Confirm the public one-liner. Confirm the destination URL. Do not test production CODE discounts on a public Reel “just to see.”

Regulated clients (clinics, supplements, finance-adjacent): read their vertical article before you add a catch-all. Clothing SIZE on the wrong SKU is on you if you scoped media lazily. Screenshot CommentLink with another client’s handle visible is how you lose the next pitch. Separate tabs. Acme’s queue depth is not Bravo’s.

Kill switch: retainer end, recall, scandal, legal letter

1. Pause automations named for that client. Dead drop URLs do not get a farewell week.
2. Disconnect the Instagram connection. Do not keep a webhook “just in case they come back.”
3. Remove staff. Export only what the contract says you may keep — usually not their audience DMs as a souvenir.
4. If they move in-house, walk their social lead through the connection on a call. Do not transfer by sharing passwords.
5. Mid-retainer: product recall, legal letter, creator scandal — pause first, argue later. Name a person who is not on a flight.

Weekly per client: connection health, dead media, one outcome they already believe — not a fake open rate. Same discipline as the weekly dashboard article, never mixed across brands.

Pitch-deck nouns we will not allow

Live comment triggers, Trial Reels modes, Broadcast Channel posting, Click-to-DM ads management, Shopify catalog messaging, HubSpot/Salesforce native sync, Meta Business Agent, silent comment-to-WhatsApp. Sell official comment-to-DM, Story reply rules, a shared inbox, naming, QA, and pause discipline. That is enough for most retainers. Lying in the pitch is how you spend the retainer on refunds. Do not ship a 30-node canvas a client cannot pause.

Offboarding sentence the client can read

“On the last day we pause every rule prefixed client-acme, disconnect Meta login, remove our users, and hand you a list of remaining live URLs. We do not keep your inbox. We never had your Instagram password. If a Reel is still teaching LINK after we leave, that is a rule we should have paused — tell us before the call ends.” Write that in the MSA so offboarding is a checklist, not a vibe.

FAQ

How do agencies run AutoDM for many clients?

Separate connections, naming, test accounts, and a kill switch when the contract ends. No passwords.

Can we use one CommentLink login for five Instagrams?

Workspace access is not the same as mixing Instagram connections. Each Professional account connects separately. Do not share rules across brands.

What is the first QA step?

Second-account test on a throwaway keyword, then the real word, before the launch Reel.

Who pauses when legal calls?

Name a person. Pause first. Offboarding is the same buttons with a checklist.

Should we keep client DMs after the retainer?

Follow the contract and privacy law. Default: you do not take their inbox with you.

Can we promise ads or CRM sync in the proposal?

Not as CommentLink native. Pitch official APIs, naming, QA, and pause discipline.

Can one CommentLink workspace user see five client Instagrams?

Workspace access is not mixing Instagram connections. Each Professional account connects separately. Do not share rules across brands.

Client insists unofficial login is faster for the intern. Allow it?

No. Official Meta OAuth only. Unofficial tools are out of scope and unsafe. Refuse the password spreadsheet.

Should we promise HubSpot deals from comments in the proposal?

Not as CommentLink native. Pitch tags, naming, QA, and pause. They join leads the way they already join inbound email.

Related reading

• Multi-account
• Testing