Chatbots

The Chatbots service operates multiple store assistants and exposes them through hosted or WhatsApp channels. Each chatbot is a store-scoped instance with channel-specific configuration.

Dashboard Areas

Area	Purpose
Chatbots	Create assistants and review their configured channels.
Hosted Chatbots	Manage public hosted chatbot endpoints and enabled state.
WhatsApp	Manage Meta Business Messaging connections and webhook status.

Hosted Chatbots

A hosted configuration has a public key, public URL, enabled state, and associated chatbot instance. Use hosted chat for a managed web experience, pilot, or shareable customer channel.

Before publishing:

• Confirm the assistant's tools and store scope.
• Test prompt, product, cart, order, and escalation behavior.
• Decide whether the public endpoint should be enabled.
• Verify that secrets and internal configuration are not exposed to the client.

WhatsApp Connections

Each WhatsApp connection has its own callback URL and backend-generated verify token. Configure both values in the corresponding Meta App Dashboard and subscribe to the messages field.

Operational data includes phone number, WhatsApp Business Account ID, connection status, and last webhook time. Unpublished Meta applications receive dashboard test events only.

Mutual TLS can be required for webhook requests in deployments that validate Meta client certificates. Enable it in Meta only after ingress validation is configured and tested.

Usage Scenarios

• Publish a product discovery assistant on a hosted page.
• Operate separate assistants for different brands or store experiences.
• Connect a WhatsApp assistant to catalog and order tools.
• Pilot a chatbot with read-only product access before enabling cart actions.
• Disable one customer channel without deleting the underlying chatbot.
• Use last webhook activity to investigate a disconnected WhatsApp integration.

Channel Checklist

• The chatbot belongs to the intended store.
• Tool permissions match the channel's purpose.
• Customer-facing responses have fallback and escalation behavior.
• Callback URL and verify token are copied to the correct Meta application.
• Webhook delivery is tested before launch.
• Public endpoints have abuse, rate, and monitoring controls.
• Customer data handling follows the merchant's privacy requirements.
• A channel can be disabled quickly during an incident.