your system, inside the conversation.
heysteff is the AI platform for customer support and sales over WhatsApp, Instagram, Messenger, Gmail and Shopify; Steff is the AI agent that runs it. An agent that only knows its knowledge base answers in generalities. One that can query your ERP on the spot answers with real stock, the status of that order and that customer's balance. Custom tools are what build that difference.
If your system speaks HTTP, it connects
Your ERP or CRM does not need an official heysteff integration. You define a tool with its URL, its method, its parameters and how it authenticates, and from then on the agent can call it inside the conversation whenever the situation calls for it.
That covers precisely where other platforms' prebuilt integrations fall short: the in-house ERP, the regional CRM, the internal system your team built years ago that nobody else supports.
Five ways to authenticate, credentials encrypted
Each tool authenticates however your backend needs it to: no auth, a bearer token, a custom header, basic, or HMAC signing. Credentials are stored encrypted and decrypted only at the instant the call runs.
HMAC is the strongest mode: heysteff signs every request with a timestamp and a hash of the body, so your backend can verify the call genuinely came from heysteff and that nobody captured it to replay later.
Hardened so a tool isn't a hole
Letting an AI agent call configurable URLs is a known risk, and it is treated as one. The executor blocks SSRF: it rejects localhost, private ranges and link-local addresses, and re-checks every IP after resolving the domain — so a DNS that changes its answer midway cannot point at your internal network.
Responses are capped at a maximum size so an endpoint that returns too much cannot bloat the conversation, every call has a timeout with a hard ceiling, and parameter interpolation accepts only a whitelist of values: no eval, no template engines, no way to inject code through what the customer types.
If your API fails, the conversation continues
A slow or down third-party endpoint should not take customer support with it. When a tool fails, expires or returns something unexpected, the error is handed to the agent as just another result instead of being thrown as an exception.
The agent reads it, interprets it and keeps working — it can say it could not look the data up, offer something else, or escalate to a person. What does not happen is the customer waiting for an answer that is never coming.
Frequently asked questions
Does my system need an official heysteff integration?
No. If your system exposes an HTTP endpoint, it can be connected. You define the tool with its URL, its method, its parameters and how it authenticates, and from then on the agent can call it inside the conversation. That covers in-house or uncommon ERPs and CRMs — exactly where other platforms' prebuilt integrations stop short.
How are my API credentials protected?
Each tool's credentials are stored encrypted and decrypted only at the moment the call runs. There are five authentication modes: none, bearer token, custom header, basic, and HMAC signing. With HMAC, heysteff signs every request with a timestamp and a hash of the body, so your backend can verify the call really came from heysteff and was not captured and replayed later.
What happens if my API goes down or responds slowly?
The conversation does not break. Each tool has its own timeout and a hard ceiling, and if the call fails, expires or returns something unexpected, the error is handed to the agent as just another result — never thrown as an exception. The agent reads it and keeps working, instead of leaving the customer waiting for an answer that never arrives.
◆ next step
Connect your ERP or CRM and let Steff answer with real data, not generalities.
You might also like: automation flows, MCP server, WhatsApp payments, connect your ERP or CRM via webhook and security.