Systems
Architect and engineer
WhatsApp AI Assistant SaaS
A multi-tenant SaaS that sells Claude-powered WhatsApp assistants to small businesses. An operator onboards clients; each business owner gets a scoped dashboard for the bot, its knowledge and human handoff.
Stack
Node.js, Express, Claude API, WhatsApp Business Cloud API, PostgreSQL, Prisma, React, Tailwind CSS, Docker
Problem
Small businesses answer the same WhatsApp questions all day: hours, services, prices. They need an assistant that knows their business, hands over to a person when it should, and cannot run up an unbounded AI bill.
Interface
Architecture
What I built
- Per-tenant webhook with X-Hub-Signature-256 HMAC verification and redelivery dedup on Meta message IDs.
- System prompt built per tenant from hours, services, pricing and FAQs, with prompt caching across a customer's turns.
- Conversation memory of the last 10 turns per customer, serialised per conversation to avoid races.
- Human handoff: the owner takes over, replies from the dashboard through the business's own WhatsApp number, then resumes the bot.
- Knowledge base of typed articles and PDF, TXT or Markdown uploads; text is extracted, originals discarded, within a 16k-character prompt budget.
- Usage caps: monthly conversation limits per tier, a daily Claude token budget, 20 AI calls per customer per hour, warnings at 80%.
- Two-tier RBAC where cross-tenant requests return 404, TOTP 2FA, Google and Microsoft OAuth, JWT token-version revocation, three-layer rate limiting and prompt-injection guardrails.
- Production boot refuses a weak JWT secret, and the webhook fails closed without the app secret.
Proof
- About 45 REST endpoints, documented
- Railway deploy with a /health check
Stack
- Node.js
- Express
- Claude API
- WhatsApp Business Cloud API
- PostgreSQL
- Prisma
- React
- Tailwind CSS
- Docker
Share this case