02Automation & integrations · Operations

CRM & WhatsApp Automation Engineering

Python tooling that audits and safely edits hundreds of live sales-automation flows in a CRM — plus the signed, expiring invite links that connect those WhatsApp automations to a members-area website.

Client: Digital-marketing agency (name withheld)
Role: Tooling, migrations and integration design
Year: 2026
Status: In use on production flows

≈400

production flows audited through the API

247

flows migrated with backup and rollback

109

embedded scripts fixed for a timezone bug

32 → 0

overlapping blocks after auto-layout

Context

The agency's sales run on WhatsApp funnels built as hundreds of flows inside a CRM. Changing them by hand was slow and risky, and a vendor API migration was about to break some of them.

The problem

Make large changes to production automations safely, find what will break before it breaks, and connect the CRM to the agency’s own sites without fragile workarounds.

What I did

01
Wrote Python tooling around the CRM's REST API with one pattern for every change: dry run → backup → apply → read-back verification → one-command rollback.
02
Designed HMAC-signed, expiring invite links shared between the CRM automations and a Next.js members area.
03
Specified a rate-limit-safe redesign of the platform's lead webhook after a burst of 429 errors.

What it does

Datetime fields migrated to filterable date fields across 247 flows
Survey of every flow still calling vendor API routes scheduled for shutdown
Automatic layout of flow diagrams with before/after SVG previews
Branch cloning to add a new product to a multi-step WhatsApp funnel

Engineering highlights

01
Change management for automations
Every batch edit runs dry first, backs up each flow, patches through the API, re-reads to compare, and ships with a rollback script.
02
A timezone bug at scale
Scripts inside the CRM ran in UTC and recorded the next day between 21:00 and midnight local time. 109 script blocks in 63 flows were fixed to use America/Sao_Paulo.
03
Graph layout for flow diagrams
Longest-path columns, swimlanes per section and overlap checks rearrange tangled flows: overlapping blocks went from 32 to 0 on the largest ones.
04
Contract-tested invite links
8-hour HMAC-SHA256 links with constant-time comparison, checked in the Next.js proxy. A harness runs the CRM's real JavaScript block against the site's rules: 19 cases across 3 flows.

Hard parts

01
A vendor API shutdown
A read-only survey found 47 flows and 71 blocks still calling deprecated routes before the old hosts were switched off.
02
Shared rate limits
The CRM allows 60 requests per minute per route on a single counter. The webhook redesign uses a debounced, persistent queue with a ~40/min budget and Retry-After handling.

Results

Invite-link expiry verified in production with a test matrix: expired, valid, lifetime, tampered and stripped links.
Every change to production flows is reversible with one command.

Figures come from the repository: tests, measurements and documented reports.

Stack

Python
JavaScript
TypeScript
REST APIs
Webhooks
HMAC-SHA256
Next.js

ProcessBuilt with AI coding assistance under my direction; every change follows the same dry-run, verify and rollback discipline.

Code and client are private. Details are shared to the extent the work allows.

CRM & WhatsApp Automation Engineering

Client

Digital-marketing agency (name withheld)

Role

Tooling, migrations and integration design

Year

2026

Status

In use on production flows

What I did

Wrote Python tooling around the CRM's REST API with one pattern for every change: dry run → backup → apply → read-back verification → one-command rollback.

Designed HMAC-signed, expiring invite links shared between the CRM automations and a Next.js members area.

Specified a rate-limit-safe redesign of the platform's lead webhook after a burst of 429 errors.

Engineering highlights

Change management for automations

Every batch edit runs dry first, backs up each flow, patches through the API, re-reads to compare, and ships with a rollback script.

A timezone bug at scale

Scripts inside the CRM ran in UTC and recorded the next day between 21:00 and midnight local time. 109 script blocks in 63 flows were fixed to use America/Sao_Paulo.

Graph layout for flow diagrams

Longest-path columns, swimlanes per section and overlap checks rearrange tangled flows: overlapping blocks went from 32 to 0 on the largest ones.

Contract-tested invite links

8-hour HMAC-SHA256 links with constant-time comparison, checked in the Next.js proxy. A harness runs the CRM's real JavaScript block against the site's rules: 19 cases across 3 flows.

Hard parts

A vendor API shutdown

A read-only survey found 47 flows and 71 blocks still calling deprecated routes before the old hosts were switched off.

Shared rate limits

The CRM allows 60 requests per minute per route on a single counter. The webhook redesign uses a debounced, persistent queue with a ~40/min budget and Retry-After handling.