User Management
Manage team access, account roles and workspace membership.
Create User Directly
All Users
Issue a login code to require admin approval for a staff account. This signs out its current device. Codes expire in 15 minutes, work once, and a new code is needed after every logout.
Invitation Codes
Generate Codes
Active Codes
Agent API Keys
Create Key
Long-lived keys for AI agents / MCP / automation. read = monitoring only (every write is rejected), full = can send messages and change settings. The key is shown once.
A local-agent key is created automatically on server start and written to .mcp-auth/token. It can use every Telegram/WhatsApp account already in the database — no login code per account, and agents do not need you to paste a token. Revoking it only lasts until the next restart unless OPENCODETG_LOCAL_AGENT=0.
Keys
Connect an agent (MCP)
Full guide: MCP_AGENT_SETUP.md in the repo. REST monitoring endpoints: /api/agent/overview, /api/agent/events, /api/agent/logs, /api/agent/endpoints.
Voice AI
How it works
Brain: a Vapi assistant decides what to say (its prompt, model and memory, via Vapi's Chat API). Voice: ElevenLabs or OpenAI turns the text into audio (Vapi has no standalone text-to-speech endpoint). The result is delivered as a real Telegram / WhatsApp voice note — manually from the chat composer, in bulk, via the REST/MCP API, or automatically as replies to incoming messages (per-account setting).
Settings
📞 Phone calls
Calls are placed by Vapi from the imported number above (free Vapi numbers cannot call out). To receive summaries/transcripts automatically, set the assistant's or number's Server URL in the Vapi dashboard to with the webhook secret.
Recent voice messages
Facebook & Messenger
Setup status
Quick connect — paste a Page token (fastest)
Already have a Page access token? Paste it here and the Page is connected straight away — no Meta app setup needed to start sending. Get a token in a minute from Meta's Access Token Tool (pick your Page under "Page Access Token") or from your Page's Settings → Linked accounts / Professional dashboard → Page access token.
Or connect with Facebook (recommended for incoming messages)
Log in with the Facebook account that manages your Page, tick the Page, and Messenger messages arrive in this dashboard. This needs the Meta app credentials from the next card.
Step 1 — Create the Meta app (one time)
- Open developers.facebook.com/apps → Create app → type Business.
- In the app dashboard add the products Facebook Login and Messenger.
- Under App settings → Basic copy the App ID and App Secret into Step 2.
- Still on Basic, add your dashboard URL to App Domains and save.
Step 2 — Paste the credentials
The webhook verify token is generated for you when you save — you never have to invent one.
Step 3 — Give Meta these URLs
Copy each value into the matching field in your Meta app, then save there.
| Where in Meta | Value to paste |
|---|---|
| Facebook Login → Settings → Valid OAuth Redirect URIs | |
| Same list, if you also use Login with Facebook | |
| Messenger → Webhooks → Callback URL | |
| Messenger → Webhooks → Verify token | |
Click any value to copy it. Under Messenger → Webhooks subscribe the Page to messages and messaging_postbacks. Facebook only accepts a public https:// webhook URL, so the dashboard has to be reachable from the internet.
Setup status
Quick connect — paste a Page token for the IG account
Paste a Page access token for a Facebook Page that has your Instagram Professional account linked. Get one from Meta's Access Token Tool.
Or connect with Instagram (OAuth, recommended)
Users open the dashboard → IG button → Connect with Instagram. The Instagram account needs to be a Professional account (Business or Creator) linked to a Facebook Page.
Instagram messaging shares the Meta app. If Facebook & Messenger is already configured, leave the fields below empty and it just works.
Instagram-specific Meta app (optional)
Only fill this in to use a different Meta app for Instagram than for Facebook.
Give Meta these URLs
| Where in Meta | Value to paste |
|---|---|
| Facebook Login → Valid OAuth Redirect URIs | |
| Instagram → Webhooks (Callback URL) — same Meta app | |
| Webhooks → Verify token (shared with Facebook) | |
In the Meta app add the product Instagram → Instagram API with Facebook Login and request the instagram_manage_messages permission. Subscribe webhook field messages.
TikTok
Setup status
Quick connect — paste a Business access token
Have a long-term Business API access token and its open_id (business_id)? Paste both to connect a TikTok Business Account without OAuth.
Step 1 — Create the TikTok app (one time)
- Open developers.tiktok.com → Manage apps → create an app.
- Add Login Kit and request Business Messaging API access (data-security review required — see the Access guide).
- Copy the App ID (client key) and App Secret into Step 2.
- In the app's Login Kit → Redirect URIs, add the callback URL from Step 3.
TikTok's messaging API only serves Business Accounts (with Advanced Access / verified status), and is unavailable for accounts registered in the EEA, Switzerland and the UK. Personal (App) logins connect but cannot exchange DMs — TikTok offers no API for them.
Step 2 — Paste the credentials
Step 3 — Give TikTok these URLs
| Where in TikTok | Value to paste |
|---|---|
| Login Kit → Redirect URI | |
| Webhooks (Business Messaging) → Callback URL, event DIRECT_MESSAGE | |
Users then connect from the dashboard → TT button → choose TikTok App or TikTok Business Account. Replies stay inside TikTok's 48-hour / 10-message customer-service window.
LINE
How LINE connects
Every LINE account in the dashboard is one Messaging API channel (a bot). There are no global credentials — each user pastes their own Channel ID + Secret from the LINE Developers console.
- LINE Developers console → your provider → Create a Messaging API channel.
- Dashboard → LN button → paste the Channel ID and Channel Secret (Basic settings tab).
- Copy the per-account webhook URL below into the channel's Messaging API → Webhook URL and enable Use webhook.
iMessage
How iMessage connects
Apple does not offer an iMessage API, so this channel talks to a BlueBubbles server running on an always-on Mac signed into iCloud with iMessage enabled. Each user pastes their own server URL + password from the dashboard's iM button — no global credentials needed.
- Install BlueBubbles on the Mac and sign into iMessage.
- BlueBubbles → Settings → API/Development → set a server password (and note the URL).
- Dashboard → iM button → paste URL + password.
Incoming messages are polled every 10 seconds; chat history is read live from the Mac.
WhatsApp Business API (Cloud API / OAuth / BSP)
Setup status
How users connect numbers (SaleSmartly flow)
In the dashboard, click the green W button → WhatsApp API (商业号) and choose one of three paths:
- Meta Cloud API (Direct) — paste Phone Number ID, optional WABA ID, and a permanent System User Access Token.
- Authorize WABA (Facebook OAuth) — sign in with Facebook to auto-import all business phone numbers on your Meta Business portfolio.
- BSP Partner Key (YCloud / 360dialog) — paste your BSP API Key, click Load Numbers, and pick your registered business number (no Meta App needed).
Meta App credentials (optional if Facebook & Messenger is already configured)
Used for Authorize WABA (OAuth) and X-Hub-Signature-256 verification. Leave blank to share the Facebook Meta App.
Webhook & OAuth URLs (click to copy)
| Where to paste | Value |
|---|---|
| Meta App → WhatsApp → Configuration → Callback URL (also 360dialog) | |
| Meta App → WhatsApp → Configuration → Verify token | |
| Facebook Login → Valid OAuth Redirect URIs | |
| YCloud Console → Developers → Webhook Endpoint | |
In Meta App → WhatsApp → Configuration, subscribe to webhook fields messages and message_template_status_update.
Desktop License Keys
Generate License Keys
All License Keys
Riser Leads
Riser (riserphone.com) — contacts become leads
Riser's Developer API works on contacts only — it has no send-message endpoint — so this integration imports your Riser contacts as Workbench leads (owned by you). Reach out over your existing WhatsApp / Telegram accounts using the imported phone number. Get the Account ID + Developer API key from your Riser account settings, or email hello@riserphone.com.
Inbound messages — webhook
Paste this into Riser's “Webhook URL to call when message comes in” field. When a customer texts your Riser number, the message lands here and — if the phone matches a lead — as a system comment on that lead's review chat (Workbench → Leads → 💬).
Recent inbound messages
Payment Settings
Crypto Wallet Addresses
These addresses are shown on the public payment page when customers select a coin.
Telegram Support Link
Customers are redirected here after selecting their payment method to send proof of payment.
Login History
Multiple-device login alerts
Staff accounts allow one device at a time. When an account signs in somewhere else, the older session is closed automatically and recorded here so you can check whether the credentials are being shared.
Sign-in history
📊 Workbench — Outreach CRM
Every user's outreach tracker. Pick a user (or view all), inspect their entries, fix mistakes, and watch the live totals — the same sheet users edit from the dashboard.
📝 Daily Reports — end-of-day sheets
The reports staff write when they sign out. One sheet per day — browse with the arrows or the date box, check the totals row, see who signed out without reporting, and search every past date for a reference.