Building a WhatsApp AI support bot for SMEs

For many Kenyan businesses, WhatsApp is the customer service channel. Customers ask about prices, delivery areas, opening hours and order status, often late at night. An AI assistant can answer most of these instantly, take bookings or payments, and pass the tricky ones to a person.

Here is how a well-built WhatsApp AI bot works, and what to watch out for.

The building blocks

1. WhatsApp Business Platform (Cloud API). Meta’s official API for businesses. Your number is registered on it, and messages arrive at your server through webhooks.
2. Your server. Receives messages, decides what to do, and sends replies through the API.
3. A knowledge base. Your price list, FAQs, policies and product info, stored so the AI can look things up.
4. A language model. Writes the reply, grounded in what it found in your knowledge base.
5. A handoff path. A way for staff to see the conversation and take over.

The regular WhatsApp Business app on a phone cannot be automated this way. You need the Business Platform, set up through a Meta Business account.

Step 1: Receive messages with a webhook

When you configure the webhook in the Meta developer dashboard, Meta first sends a GET request with a hub.challenge value. Your server must echo it back if the hub.verify_token matches the token you chose. After that, every incoming message arrives as a POST.

// Verify the webhook (GET)
export function GET(req: Request) {
  const url = new URL(req.url);
  if (
    url.searchParams.get("hub.mode") === "subscribe" &&
    url.searchParams.get("hub.verify_token") === process.env.WHATSAPP_VERIFY_TOKEN
  ) {
    return new Response(url.searchParams.get("hub.challenge"));
  }
  return new Response("Forbidden", { status: 403 });
}

Every POST from Meta includes an X-Hub-Signature-256 header: an HMAC-SHA256 of the raw body using your app secret. Check it before trusting the payload.

import { createHmac, timingSafeEqual } from "node:crypto";

function isFromMeta(rawBody: string, signature: string | null) {
  if (!signature) return false;
  const expected = "sha256=" + createHmac("sha256", process.env.META_APP_SECRET!).update(rawBody).digest("hex");
  return expected.length === signature.length && timingSafeEqual(Buffer.from(expected), Buffer.from(signature));
}

Reply to Meta with 200 OK quickly, then process the message in the background. If your server is slow, Meta retries, and you risk answering twice. Store each message ID and skip duplicates.

Step 2: Understand the 24-hour window

WhatsApp has an important rule. When a customer messages you, a 24-hour customer service window opens. Inside it, you can reply freely with normal messages. Outside it, you can only start a conversation with a pre-approved message template, such as an order update or appointment reminder.

For a support bot this works well: the customer writes first, and the bot replies inside the window. For reminders, receipts or promotions sent later, plan your templates and get them approved in advance.

Meta charges for template messages by category (marketing, utility and authentication), and the rates differ by country. Replies inside the customer service window are generally free. Check Meta’s current rate card for Kenya before estimating costs.

Step 3: Answer from your own content (RAG)

A bare language model will happily invent a delivery fee. The fix is retrieval-augmented generation (RAG):

1. Split your documents (price list, FAQs, policies) into short chunks.
2. Store an embedding (a numeric fingerprint) of each chunk. Postgres with the pgvector extension, available on Supabase, works well.
3. For each customer message, find the most relevant chunks.
4. Give the model those chunks and strict instructions: answer only from this information, keep it short, and offer a human when unsure.

const system = `You are the WhatsApp assistant for ${business}.
Answer ONLY using the information provided. If the answer is not there, say you'll
connect the customer with a team member. Reply in the customer's language
(English or Swahili). Keep replies under 80 words. Never invent prices.`;

Keep your knowledge base up to date. When prices change, update the document and re-index it, with no retraining needed.

Step 4: Let the bot do things, carefully

The most useful assistants don’t just answer, they act:

• Check order status by calling your order system.
• Take a booking and confirm a time slot.
• Collect payment by triggering an M-Pesa STK Push to the customer’s number.

Give the model a small set of well-defined tools and validate every input on your server. The model should never be able to, for example, change a price or refund money on its own.

Step 5: Hand over to a human

No bot handles everything. Build in clear triggers for handoff:

• The customer asks for a person.
• The model isn’t confident, or the topic is sensitive (complaints, refunds, medical questions).
• The same question gets asked twice.

When it happens, pause the bot for that conversation, notify your team (on a dashboard, by email or in a staff WhatsApp group), and show them the full history so the customer doesn’t have to repeat themselves.

Swahili and Sheng

Modern models handle Swahili and mixed English–Swahili well. Test with how your customers really write, including abbreviations and Sheng, and make sure prices, dates and phone numbers come back in a consistent format.

Privacy and the Data Protection Act

Conversations contain personal data. Tell customers they’re chatting with an automated assistant, keep only what you need, restrict who can read logs, and choose providers with clear data-processing terms. If you’re unsure about your obligations under the Kenya Data Protection Act 2019, take legal advice.

What it costs to run

Monthly running costs usually include:

• Meta charges for template messages (support replies inside the window are generally free).
• AI model usage, priced per token. For short support replies this is usually small.
• Hosting and database, often a few thousand shillings a month for an SME.

We give every client a running-cost estimate based on their expected message volume before building.

Getting started

A focused first version, answering FAQs from your documents with human handoff on one WhatsApp number, can usually go live in two to four weeks. From there you can add bookings, payments and integrations with your systems.

Want one for your business? See our AI chatbot service or send us a message.