How I Built an AI Customer Support Agent with n8n, WhatsApp API, and Supabase

1. The Problem with Naive Chatbot Wrappers

Most AI chatbots deployed today suffer from two fatal flaws: they either hallucinate business policies (inventing return windows, discounts, or inventory items) or they break as soon as user traffic spikes on messaging channels like WhatsApp.

When building Hukum AI (hukum.tech), my goal was to resolve routine, repetitive customer inquiries autonomously without requiring business owners to hire 24/7 support staff. Doing this reliably meant creating a deterministic software boundary around the LLM, rather than sending unvalidated prompts to an API.

2. High-Level Architecture Overview

The architecture divides responsibilities across four distinct layers:

• Ingestion Tier: A Python Flask API and n8n webhook listeners that verify Meta WhatsApp HMAC signatures and ingest incoming messages.
• Context & Multi-Tenant Store: Supabase (PostgreSQL) storing business profiles, custom prompt matrices, document embeddings, and conversation histories with strict Row-Level Security (RLS).
• LLM Reasoning Engine: OpenAI GPT models configured with strict JSON output schemas, temperature 0.2, and system prompt constraints.
• Human-in-the-Loop Gateway: An operator dashboard in React (Vite) where live human support agents can intervene at any moment.

3. Handling WhatsApp Cloud API Webhooks

WhatsApp Cloud API requires instant HTTP 200 acknowledgments (typically under 3 seconds). If your server takes too long generating an LLM response, Meta will retry the webhook, resulting in duplicate user responses.

To resolve this, I implemented an asynchronous dispatch pattern:

@app.route('/api/webhook/whatsapp', methods=['POST'])
def whatsapp_webhook():
    payload = request.get_json()
    
    # 1. Immediately validate message structure
    if not is_valid_whatsapp_payload(payload):
        return jsonify({"status": "ignored"}), 200
        
    # 2. Dispatch processing to asynchronous worker queue
    task_queue.enqueue(process_inbound_chat, payload)
    
    # 3. Acknowledge Meta immediately within <150ms
    return jsonify({"status": "received"}), 200

4. Preventing Hallucinations with In-Context RAG

In Hukum AI, businesses upload their policy documents, FAQ lists, and product catalogs as PDFs or Word files. Rather than allowing the LLM to guess, our pipeline extracts the text blocks, cleans special formatting, and embeds the content directly into the customer's tenant configuration in Supabase.

The prompt matrix is formulated strictly:

"You are the official customer support assistant for {business_name}. Answer solely based on the verified Knowledge Base below. If the answer is not present, politely inform the user that you are connecting them to a human representative."

5. Multi-Tenant Data Isolation with Supabase RLS

When multiple business clients share the same database instance, data leakage between tenants is catastrophic. We utilized PostgreSQL Row-Level Security (RLS) policies in Supabase:

-- Enable Row-Level Security on conversation logs
ALTER TABLE customer_conversations ENABLE ROW LEVEL SECURITY;

-- Allow businesses to read only their own conversations
CREATE POLICY "Tenant isolation for conversation records"
ON customer_conversations
FOR SELECT
USING (auth.uid() = tenant_id);

6. Real-World Results

Across active deployments on Hukum.tech, this architecture achieved:

• Autonomous resolution of repetitive customer inquiries and FAQ triage without human intervention.
• Sub-2 second response latency on web chat widgets.
• Zero data leakage incidents thanks to PostgreSQL RLS policies.