A sales agent that stays up

The instinct is to write one script that listens and replies. That version works in a demo and falls over the moment you need to know why it said something. This splits the work: a webhook that receives, a model that drafts, a database that remembers, a scorer that tracks intent, a host that stays up, and a voice layer you can ignore until you need it. Each piece can be debugged and replaced on its own.

It talks to the official Cloud API directly rather than driving WhatsApp Web through browser automation. The popular automation libraries are genuinely good and widely used, but they drive the consumer web client, and their own documentation warns that accounts can be blocked. For something a business depends on, the official transport is the one that does not put the number at risk.

git clone YOUR_REPO_URL
cd ai-sales-agent
cp .env.example .env
npm install
npm run dev

# prove it is alive before connecting anything
curl http://localhost:8080/health

Change one module at a time, and keep the webhook, database, model client and voice layer separate in your instructions. The separation is not academic: it is what stops a cosmetic UI change from breaking live customer messaging. Also — do not commit the .env file.

SUPABASE_URL=https://YOUR_PROJECT.supabase.co
SUPABASE_SERVICE_ROLE_KEY=YOUR_SERVER_ONLY_KEY

It bypasses row-level security by design. It belongs in the worker and nowhere else — never in a browser app, never in the front-end, never in anything shipped to a client. Growing past the starter means conversation summaries, embeddings for product knowledge, staff authentication and a real handoff queue; none of that changes where this key lives.

WHATSAPP_VERIFY_TOKEN=make-a-random-string
WHATSAPP_APP_SECRET=YOUR_META_APP_SECRET
WHATSAPP_ACCESS_TOKEN=YOUR_PRODUCTION_TOKEN
WHATSAPP_PHONE_NUMBER_ID=YOUR_PHONE_NUMBER_ID
META_GRAPH_VERSION=v23.0

AI_API_STYLE=responses
AI_API_BASE_URL=https://api.openai.com/v1
AI_API_KEY=YOUR_KEY
AI_MODEL=your-model
BUSINESS_NAME=Your Business
BUSINESS_CONTEXT=Products, pricing, policies, FAQs, availability, booking rules.

The system instruction explicitly forbids inventing stock, prices, delivery dates, discounts, policies or guarantees. When the data is missing, the correct behaviour is to say so and offer a human. An agent that confidently makes up a delivery date is worse than no agent, because a customer will hold you to it. Put product facts in structured data or a retrieval layer rather than a sprawling “remember everything about my company” prompt.

VOICE_ENABLED=true
OPENAI_API_KEY=YOUR_KEY
OPENAI_REALTIME_MODEL=your-realtime-model
OPENAI_REALTIME_VOICE=your-voice

This gives the business a normal phone channel. WhatsApp messaging stays on the Cloud API — the two are separate integrations. If your account has access to WhatsApp calling features, treat that as its own piece of work with its own eligibility rules, not as something this turns on.

sudo apt update
sudo apt install -y git curl
curl -fsSL https://deb.nodesource.com/setup_20.x | sudo -E bash -
sudo apt install -y nodejs
sudo npm i -g pm2

git clone YOUR_REPO_URL
cd ai-sales-agent
cp .env.example .env
nano .env
npm ci
npm run build
pm2 start ecosystem.config.cjs
pm2 save
pm2 startup

cd web
vercel

Read the entire repository first. Do not change architecture yet.

Goal: adapt this 24/7 WhatsApp AI sales agent for [BUSINESS].

Business facts:
- products/services: [INSERT]
- pricing: [INSERT]
- customer FAQs: [INSERT]
- delivery/booking rules: [INSERT]
- refund/cancellation rules: [INSERT]
- human handoff contact/process: [INSERT]

Tasks:
1. Update BUSINESS_CONTEXT and the sales prompt.
2. Add only the business tools we actually need.
3. Never invent stock, prices, policies or dates.
4. Keep the messaging API, database and VPS worker separated.
5. Keep secrets in env vars.
6. Run typecheck after every meaningful change.
7. Explain every file you change and why.

Do not add unnecessary frameworks.

This is deliberately small enough to read and understand in an afternoon, which is exactly why it is useful. Real production scale needs authentication, observability, queues, retries, access controls, compliance work and business-specific tooling. Knowing which of those you still owe is the difference between shipping and being surprised.

Commands, environment variable names and the acceptance tests are as given in the source guide. The star counts for every referenced project were re-checked against GitHub on 16 September 2026: five of six matched, and the customer-desk figure was corrected upward. Model and voice identifiers are left as placeholders rather than pinned, since those move faster than anything else here.