Build apps for Gwiksoft businesses

Gwiksoft is an AI sales assistant for Indian businesses on WhatsApp, their website and Instagram. Apps extend what a business can do with it: send leads to the tools they already use, add bookings and catalogues, or bring a whole new workflow into their dashboard.

An app appears in the business dashboard under Settings → Apps, next to the apps Gwiksoft ships today (Shopify, CRO, HubSpot, Zoho CRM, Google Sheets). A business owner installs it in two clicks, approves exactly what it may see and do, and can remove it at any time.

Building an AI agent? See Agents: connect any agent to a business’s catalogue, offers and bookings over MCP, answer its customers with your own agent, or give the Gwiksoft AI a new tool.

Status and roadmap

The platform opens in three phases. Dates follow once each phase is in testing with early-access developers.

Concepts

Build your first app

The planned flow for a public app (Phase 3). Private apps (Phase 2) skip steps 1, 3 and 4: the business creates an API key and gives it to you.

1. Register the app in the developer console with its manifest: name, redirect address, scopes, webhook address.
2. Test it on a free development business that comes with sample products, chats and leads.
3. Send the owner to install: your “Connect to Gwiksoft” button opens the install screen; the owner approves; you receive a code and exchange it for tokens.
4. Submit for review; once approved the app is listed in Settings → Apps.
5. Call the API and receive webhooks for each business that installed it.

# 1. A lead arrives: your webhook receives it
POST https://your-app.example.com/gwiksoft/webhooks
X-Gwiksoft-Event: lead.created
X-Gwiksoft-Signature: t=1793722000,v1=5f0c…

# 2. You read the conversation it came from
GET https://api.gwiksoft.com/v1/conversations/conv_8kq2…/messages
Authorization: Bearer gwk_at_…

App manifest

The manifest describes your app. You keep it in your code as gwiksoft.app.json and upload it when you register or update the app.

{
  "name": "ShipNow Tracker",
  "handle": "shipnow-tracker",
  "description": "Shows delivery status for every order, and tells customers on WhatsApp.",
  "developer": { "name": "ShipNow Pvt Ltd", "email": "apps@shipnow.example", "website": "https://shipnow.example" },
  "category": "Orders and delivery",
  "icon": "https://shipnow.example/icon-512.png",
  "auth": {
    "redirect_urls": ["https://shipnow.example/gwiksoft/callback"]
  },
  "scopes": ["leads.read", "conversations.read", "messages.send"],
  "webhooks": {
    "url": "https://shipnow.example/gwiksoft/webhooks",
    "events": ["lead.created", "order.intent", "app.uninstalled"]
  },
  "screens": [
    { "id": "home", "title": "Deliveries", "url": "https://shipnow.example/gwiksoft/app" }
  ],
  "privacy_policy": "https://shipnow.example/privacy",
  "support": "support@shipnow.example"
}

Install and sign-in (OAuth 2.0)

Public apps use the OAuth 2.0 authorization-code flow. The business owner, signed in to Gwiksoft, sees your app, the scopes in plain words, and approves.

1. Send the owner to the install screen

https://business.gwiksoft.com/oauth/authorize
  ?client_id=app_9f3k2…
  &redirect_uri=https%3A%2F%2Fshipnow.example%2Fgwiksoft%2Fcallback
  &scope=leads.read%20conversations.read%20messages.send
  &state=random-value-you-check-on-return

2. Exchange the code for tokens

POST https://api.gwiksoft.com/v1/oauth/token
Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code&code=…&client_id=app_9f3k2…&client_secret=…&redirect_uri=…

{
  "access_token": "gwk_at_…",
  "token_type": "Bearer",
  "expires_in": 86400,
  "refresh_token": "gwk_rt_…",
  "scope": "leads.read conversations.read messages.send",
  "business": { "id": "biz_4tq8…", "name": "Carat Jewels", "slug": "carat-jewels" }
}

3. Refresh before it expires

Access tokens last 24 hours; refresh tokens 90 days and rotate on every use. Send grant_type=refresh_token to the same endpoint. When the owner removes your app, both stop working and you receive app.uninstalled.

Private apps and API keys

A business that wants to connect its own systems (its ERP, a billing tool, a script) does not need a public app. In Phase 2 the owner creates an API key in Settings → Apps → Developer, chooses its scopes, and can revoke it at any time.

GET https://api.gwiksoft.com/v1/leads?since=2026-11-01T00:00:00Z
Authorization: Bearer gwk_live_…

Keys are shown once, start with gwk_live_ (or gwk_test_ for a development business), and belong to one business. Keep them on your server, never in a website or app that customers download.

Permissions (scopes)

Customer phone numbers and message text are personal data. Ask for conversations.read only when your app needs them, and see policies.

Screens inside the dashboard

A screen is your own web page, shown inside the business dashboard when the owner opens your app (Phase 3). It loads in a frame at the address in your manifest, with a short-lived session token:

https://shipnow.example/gwiksoft/app?business=biz_4tq8…&session=eyJhbGciOiJIUzI1NiJ9…

• Verify the session with your client secret (HS256): aud is your client id, business_id the business, sub the signed-in user, exp one minute ahead.
• Exchange it at POST /v1/oauth/token with grant_type=urn:ietf:params:oauth:grant-type:token-exchange for an access token for that business.
• Fit in: work at phone width (most owners use the dashboard on their phone), load quickly, and follow the light and dark theme passed as theme=.
• Frames are allowed only from https://business.gwiksoft.com: send Content-Security-Policy: frame-ancestors https://business.gwiksoft.com.

Agents and Gwiksoft

Every Gwiksoft business already has an AI sales assistant answering on WhatsApp, its website and Instagram. Agents can work with it in three ways:

In all three, Gwiksoft keeps what businesses rely on: the channels and WhatsApp rules, the team inbox, hand-off to a person, follow-ups, and the same honesty checks on every reply.

MCP server

Each business gets a Model Context Protocol server, so any MCP-capable agent can shop it the way a customer would in the chat: with real prices, live offers and the business’s own booking rules.

https://mcp.gwiksoft.com/b/{business-slug}      # Streamable HTTP

Tools

Open tools need no key and are rate-limited per caller; they only read what the business already shows customers. Tools that reach the business’s team need an API key or an install with the scope shown, and identify your app to the business.

Connect from code

// Node.js, with the official MCP SDK: npm install @modelcontextprotocol/sdk
import { Client } from '@modelcontextprotocol/sdk/client/index.js';
import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';

const client = new Client({ name: 'my-shopping-agent', version: '1.0.0' });
await client.connect(new StreamableHTTPClientTransport(
  new URL('https://mcp.gwiksoft.com/b/carat-jewels'),
  { requestInit: { headers: { Authorization: 'Bearer gwk_live_…' } } }  // only for keyed tools
));

const { tools } = await client.listTools();
const found = await client.callTool({
  name: 'search_products',
  arguments: { query: 'oval solitaire ring', max_price: 70000, limit: 5 },
});

// search_products result (structured content)
{
  "products": [{
    "id": "prod_7h1…", "title": "Oval Halo Ring",
    "price": 64500, "currency": "INR", "price_note": "Price depends on metal and carat",
    "collection": "Women's Solitaire Rings",
    "options": [{ "name": "Metal", "values": ["18K White Gold", "18K Yellow Gold"] }],
    "in_stock": true,
    "url": "https://caratjewels.example/products/oval-halo",
    "image": "https://cdn.example/oval-halo.jpg"
  }],
  "offers": [{ "title": "Wedding season try-on week", "discount": "10% off making charges", "ends_at": "2026-11-20T23:59:59+05:30" }],
  "more": 12
}

Assistants that accept remote MCP servers (for example as a “connector” or “custom tool”) can use the same address. On Shopify stores, Shopify also offers its own catalogue and cart MCP endpoint on the store’s domain; the Gwiksoft server adds non-Shopify catalogues, offers, bookings, the team hand-off and the business’s own rules.

Bring your own agent

With the agent.respond scope, your agent answers the business’s customers. Gwiksoft still receives every message on WhatsApp, the website and Instagram, and still runs the inbox, the hand-off to a person, follow-ups and the checks; your agent decides what to say.

1. Gwiksoft sends you the customer’s message

POST https://your-agent.example.com/gwiksoft/respond
X-Gwiksoft-Event: conversation.message
X-Gwiksoft-Signature: t=1793722000,v1=…

{
  "event": "conversation.message",
  "business_id": "biz_4tq8…",
  "conversation": { "id": "conv_8kq2…", "channel": "whatsapp", "language": "hinglish" },
  "customer": { "name": "Asha", "returning": false, "city": "Hyderabad" },
  "message": { "id": "msg_9…", "text": "Engagement ring dikhao 70k ke andar" },
  "history": [ { "from": "ai", "text": "Hi! How can I help?" } ],
  "context": {
    "viewed_on_website": ["Oval Halo Ring"],
    "offers": [{ "title": "Wedding season try-on week", "ends_at": "2026-11-20T23:59:59+05:30" }]
  },
  "respond_by": "2026-11-03T15:55:00Z"
}

2. Your agent answers

Answer the webhook directly within 20 seconds, or reply later with POST /v1/conversations/{id}/messages:

{
  "text": "Yeh teen solitaire rings ₹70,000 ke andar hain:",
  "products": ["prod_7h1…", "prod_2c4…", "prod_9d8…"],
  "question": "Kaunsa design pasand aaya?",
  "buttons": ["Book a store visit", "View more products"],
  "handoff": false
}

• Products are product ids; Gwiksoft turns them into cards (website) or photos with links (WhatsApp), and adds “View more products” when there are more.
• Buttons: up to 3, at most 20 characters each (WhatsApp’s limit).
• handoff: true gives the chat to the team and alerts their phones.
• If your agent does not answer by respond_by, the business’s fallback answers: the Gwiksoft AI, or a short “we’ll get back to you”, as the business chose.
• Before sending, Gwiksoft checks your reply like its own: prices against the catalogue, offers against the live list, no pressure. A failing reply is corrected or sent to the team, and the reason is in the webhook log.

Tools for the Gwiksoft AI

Your app can give the built-in AI a tool. It appears to the business in Settings → Apps; once switched on, the AI calls it when a customer’s question needs it.

// in gwiksoft.app.json
"tools": [{
  "name": "delivery_estimate",
  "description": "Delivery date for a pincode. Use when a customer asks when an order would arrive.",
  "input_schema": {
    "type": "object",
    "properties": { "pincode": { "type": "string", "pattern": "^[1-9][0-9]{5}$" } },
    "required": ["pincode"]
  },
  "url": "https://shipnow.example/gwiksoft/tools/delivery-estimate"
}]

POST https://shipnow.example/gwiksoft/tools/delivery-estimate
X-Gwiksoft-Signature: t=…,v1=…

{ "tool": "delivery_estimate", "arguments": { "pincode": "500034" },
  "business_id": "biz_4tq8…", "conversation_id": "conv_8kq2…" }

// your answer, within 5 seconds
{ "result": { "earliest": "2026-11-06", "latest": "2026-11-08", "cod": true } }

• Write the description for the AI: when to use the tool, not what your company does.
• Return facts, not sentences; the AI words the answer in the customer’s language.
• A tool that is slow or fails is skipped and the AI answers without it; repeated failures switch the tool off and tell the business.

Rules for agents

• Say it is an AI when a customer asks, and never pretend to be a named person.
• Only real facts: prices, stock and offers from the tools or the catalogue; no invented discounts, deadlines, stock levels or popularity.
• Hand over when the customer asks for a person, when unsure, or for complaints, refunds and legal matters.
• Respect the channel: WhatsApp’s 24-hour window and templates, “STOP” always honoured, no messages to people who did not contact the business.
• Personal data stays with the business: do not keep customers’ messages or numbers beyond answering, and never use one business’s data for another.
• Be fast: customers wait for the first answer; aim for under 5 seconds, and answer what you can before slower work.

API basics

• Base address: https://api.gwiksoft.com/v1. JSON in, JSON out, UTF-8.
• Authentication: Authorization: Bearer <token or key>. Every token acts for one business.
• Lists return { "data": [...], "next_cursor": "…" }; pass cursor for the next page, limit up to 100.
• Times are ISO 8601 in UTC; money is in rupees as a number (58000) with currency: "INR".
• Safe retries: send Idempotency-Key on POST requests; the same key within 24 hours returns the first result.

Business

{
  "id": "biz_4tq8…", "name": "Carat Jewels", "slug": "carat-jewels",
  "industry": "jewellery", "sales_motion": "showroom",
  "timezone": "Asia/Kolkata",
  "hours": { "mon": ["12:00", "20:00"], "sun": ["12:00", "20:00"] },
  "channels": ["whatsapp", "web", "instagram"]
}

Leads

Filters: since, status (new, contacted, converted, closed), intent (appointment_request, order_intent, callback, general_lead), channel, tag.

{
  "data": [{
    "id": "lead_2m9x…",
    "created_at": "2026-11-03T15:54:36Z",
    "name": "Asha Rao", "phone": "+9198XXXXXX10",
    "intent": "appointment_request",
    "status": "new",
    "channel": "whatsapp",
    "conversation_id": "conv_8kq2…",
    "product": { "id": "prod_7h1…", "title": "Oval Halo Ring", "price": 64500 },
    "requested_slot": { "date": "2026-11-07", "time": "Afternoon" },
    "tags": ["wedding"], "location": { "city": "Hyderabad" }
  }],
  "next_cursor": null
}

Add a lead from another source (a call, a walk-in, a form). Same fields; source is required and shown in the dashboard.

Change status, tags or add a note. Each change is recorded on the lead with your app's name.

Conversations and messages

Filters: channel, since, status (ai, team, waiting).

{
  "data": [
    { "id": "msg_1…", "from": "customer", "text": "Show me solitaire rings", "at": "2026-11-03T15:54:36Z" },
    { "id": "msg_2…", "from": "ai", "text": "Here are a few solitaire rings…", "products": ["prod_7h1…"], "at": "2026-11-03T15:54:39Z" },
    { "id": "msg_3…", "from": "team", "text": "Would Saturday work for a visit?", "at": "2026-11-03T16:01:12Z" }
  ]
}

{ "text": "Your order has shipped. Track it here: https://shipnow.example/t/AB12" }

Sent as the business's team, on the conversation's channel. On WhatsApp a free-form message is possible only within 24 hours of the customer's last message; after that, send an approved template with {"template": {"name": "...", "language": "en", "params": [...]}}. The AI steps back from a conversation your app writes in, as it does for a person.

Products

{
  "title": "Oval Halo Ring",
  "price": 64500, "mrp": 69000, "currency": "INR",
  "collection": "Women's Solitaire Rings",
  "images": ["https://cdn.example/oval-halo.jpg"],
  "options": [{ "name": "Metal", "values": ["18K White Gold", "18K Yellow Gold"] }],
  "stock_status": "in_stock",
  "url": "https://caratjewels.example/products/oval-halo"
}

For businesses whose catalogue lives in Shopify, products are read-only here: change them in Shopify and Gwiksoft follows.

Bookings

{ "status": "confirmed", "at": "2026-11-07T11:30:00+05:30", "note": "Ask for Priya at the counter" }

Confirming sends the customer a confirmation on their channel, and a reminder the day before.

Offers

{
  "title": "Wedding season try-on week",
  "discount": "10% off making charges",
  "applies_to": "Solitaire rings and studs",
  "starts_at": "2026-11-10T00:00:00+05:30",
  "ends_at": "2026-11-20T23:59:59+05:30",
  "terms": "Not with other offers."
}

The AI quotes live offers with their real end dates and never invents one, so an offer your app creates is what customers hear about.

Webhooks

POST https://shipnow.example/gwiksoft/webhooks
Content-Type: application/json
X-Gwiksoft-Event: lead.created
X-Gwiksoft-Delivery: dlv_5c8…
X-Gwiksoft-Signature: t=1793722000,v1=5f0c4a…

{ "event": "lead.created", "business_id": "biz_4tq8…", "created_at": "2026-11-03T15:54:40Z",
  "data": { "lead": { "id": "lead_2m9x…", "intent": "appointment_request", "…": "…" } } }

Check the signature

// Node.js
import crypto from 'node:crypto';
function verify(rawBody, header, secret) {
  const { t, v1 } = Object.fromEntries(header.split(',').map((p) => p.split('=')));
  if (Math.abs(Date.now() / 1000 - Number(t)) > 300) return false; // older than 5 minutes
  const expected = crypto.createHmac('sha256', secret).update(`${t}.${rawBody}`).digest('hex');
  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(v1));
}

Answer within 10 seconds with any 2xx. Failed deliveries are retried 6 times over 24 hours with growing gaps; use X-Gwiksoft-Delivery to ignore a repeat.

Errors and limits

{ "error": { "code": "scope_missing", "message": "This app was not granted messages.send." } }

App review and policies

Public apps are reviewed before they are listed. An app passes when it:

• Asks for the least it needs. Every scope must be used, and explained in your listing.
• Handles personal data under India's DPDP Act: customer names, numbers and messages are the business's data. Store only what you need, keep it encrypted, and delete it within 30 days of app.uninstalled or on the business's request.
• Follows WhatsApp's rules: no messages to people who did not contact the business, templates outside the 24-hour window, and “STOP” always respected.
• Does not pressure customers: no invented deadlines, stock levels, discounts or popularity. These are dark patterns under India's 2023 consumer guidelines, and the Gwiksoft AI is held to the same rule.
• Is secure: HTTPS everywhere, secrets on your server, signatures checked on every webhook.
• Is supported: a working support address that answers within two business days.

Early access

We are choosing a small group of developers and agencies to build the first apps with us in Phase 2. Tell us what you want to build, for which kind of business, and which parts of the API it needs.

• Email: support@mail.gwiksoft.com with the subject “App platform early access”
• WhatsApp or call: +91 70334 88174
• Or book a call: gwiksoft.com/book

FAQ