Built by 
About this software
About ChatFlow WA — WhatsApp Chatbot for Small Business
ChatFlow WA is a Node.js 22 and Express 5 web app that answers repeated WhatsApp customer questions about prices, hours, delivery and orders. It connects to a WhatsApp Business number through Meta Cloud API webhooks, verifying the GET token and the X-Hub-Signature-256 HMAC on POST requests. Data (settings, flows, FAQs, orders, conversations) is stored in a JSON file, so no external database is needed. The dashboard is a static single-page UI with admin and optional agent logins, and a simulated customer chat at /demo. Docker, docker-compose and setup documentation are included, along with tests for the bot, CSV import and webhook signature handling.
Why ChatFlow WA — WhatsApp Chatbot for Small Business
What makes it better
than the alternatives
- 01
Demo mode without WhatsApp
The /demo page lets you test the full customer chat with server-generated identities and rate limiting before connecting a number.
- 02
Editable keyword flow builder
Admins create, enable, reorder and remove keyword-triggered reply blocks, and a __HANDOFF__ reply passes the chat to a human.
- 03
FAQ-grounded AI with offline fallback
Optional OpenAI-compatible replies use the business FAQ; without an API key the app falls back to keyword matching.
- 04
CSV order lookup in chat
Admins import order rows (Order ID required; Customer, Status, ETA optional), and customers get status and ETA by sending an order number.
- 05
Role-separated inbox with phone masking
Admin and optional agent logins are separate, and agent views mask customer phone numbers to the last four digits.
WhatsApp Integration
- Meta Cloud API webhook endpoint at /wa/webhook
- GET verify-token check
- POST HMAC signature verification; the endpoint refuses requests if WHATSAPP_APP_SECRET is not set
- Configurable API version and phone number ID
- Live/demo mode is determined by whether an access token is set
Flow Builder
- Keyword-triggered Q&A blocks with title
- keywords
- reply and enabled toggle
- Blocks checked top to bottom
- __HANDOFF__ reply sends the chat to the agent inbox
- Server-side validation (max 100 flows)
FAQ & AI Answers
- Editable knowledge base with question
- answer and keywords (max 500 entries)
- Optional OpenAI-compatible API via OPENAI_API_KEY
- base URL and model settings
- Editable business name
- welcome
- fallback and hand-off messages
Orders
- CSV import pasted from Excel or Google Sheets
- Existing order IDs are updated on re-import
- Current orders table
- Status and ETA returned in the customer chat
Agent Inbox
- Conversation list with search box
- Status pills for Needs agent
- Resolved and Automated
- Agents and admins can reply and resolve conversations
- Message history labelled by customer
- bot or agent
Analytics
- Admin-only analytics endpoint
- Overview dashboard showing conversation and automated-answer counts
Security & Access
- Admin and optional agent roles
- Scrypt password verification with constant-time comparison
- Signed sessions that expire after 12 hours
- Same-origin checks on write routes
- Startup refuses placeholder or missing admin credentials
Deployment
- Dockerfile on node:22-alpine with npm ci --omit=dev
- docker-compose with a persistent data volume
- Environment-based configuration via .env.example
- Setup guide and webhook reference docs
- Node test suite covering bot
- CSV and webhook
| Language | Version | Framework | Used for | Share of code |
|---|---|---|---|---|
| JavaScript | — | — | Front-end | 86.3% |
| HTML | — | — | Front-end | 11.1% |
| CSS | — | — | Styling | 2.6% |
- Primary language
- JavaScript (Node.js 22+)
- Framework
- Express 5.3.0
- Database
- None: JSON file store (DATA_DIR/store.json), no SQL database
- Authentication
- Signed expiring session tokens (12 h) with admin and optional agent roles; scrypt-hashed passwords
- Licence
- Single-site
- Screens
- 8
- Database tables
- 5
- Supported languages
- English only; no translation layer in the code; RTL not implemented
- Browser support
- Not specified in source; vanilla JavaScript dashboard with no framework build step
| Minimum | Recommended | |
|---|---|---|
| CPU | 1 vCPU | 2 vCPU |
| RAM | 1 GB RAM | 2 GB RAM |
| OS | Linux with Node.js 22+ (Docker image node:22-alpine) | Linux with Node.js 22+ (Docker image node:22-alpine) |
| Est. monthly hosting | $10 | $10 |
```sh cd "Node Project" cp .env.example .env # edit .env: ADMIN_EMAIL, ADMIN_PASSWORD, SESSION_SECRET cd .. docker compose up -d --build ``` The compose file mounts a named volume at /app/data so the JSON store persists.
```sh cd "Node Project" npm ci cp .env.example .env # edit .env: replace placeholder admin credentials and SESSION_SECRET npm test npm start ``` Put the app behind an HTTPS reverse proxy for Meta webhook use, and set DATA_DIR to a persistent directory.
Quality report
Manually reviewedHow to read the quality report
What this is. Every project on Vibe96 goes through an automated audit of its source code before a reviewer in Dubai checks it by hand. The score is out of 100; 75 is the minimum to be listed, and any single failing check blocks a listing regardless of the score.
- Security
- No real credentials in the code, every data-changing route protected, admin areas role-gated, no SQL built from user input.
- Code structure
- A developer can navigate and extend it: clear module boundaries, no giant files, little copy-paste.
- Docs & completeness
- The setup guide, example config, schema and required files the builder committed to are actually in the archive.
- Dependency health
- Packages pinned, no known critical vulnerabilities, no abandoned libraries in production paths.
- Build & deploy
- A clean machine can restore, build and start it by following the shipped instructions.
Warnings are problems that didn't block the listing; they stay visible here until a later version clears them. The audit reads the code — it does not run it — so always try the live demo before you buy. Lines of code are counted from the same audited archive.
Reviewer notes (3 minor)
No real credentials found; weak default admin password and session secret fallback ship to buyers; single 'server.js' holds routes, json store, bot logic, webhook and ai client with minified one-line handlers; builds and starts from a clean machine; docker/lockfile and setup-doc gaps; no sql, so no injection; json store lacks input validation and scoping on bulk writes; admin routes guarded, but default credentials, plaintext password compare and a public demo endpoint weaken access control. None of these stop the software from working; the developer has been told and improvements come in a future update.
Versions & updates
No updates yet. New versions appear here with a changelog.
Buyers receive updates free for 1 year.
What you get
- </>Full source codeThe complete audited source, delivered as a download from your account. No obfuscation.
- ▤DocumentationSetup guide, architecture notes, CLAUDE.md and AGENTS.md.
- ↻One year of updatesEvery new version the builder publishes, free for 12 months.
- ♧30 days of supportInstallation and defect support through Vibe96 tickets.
