Skip to main content

Public Appointment Booking

The Steer Public Appointment Booking module (/booking/[token]) provides prospective automotive buyers with an unauthenticated, mobile-first self-service interface to schedule test drives and showroom consultations directly with dealership staff.

Cryptographic Token Architecture & Lifecycle​

Public booking links are secured through cryptographically robust parameters that eliminate the need for buyer accounts while preventing unauthorized enumeration or replay attacks:

Token Generation & Expiration Mechanics​

  • Token Construction: Generated via 32 bytes of cryptographically secure pseudo-randomness encoded as a URL-safe base64 string (crypto.randomBytes(32).toString("base64url")).
  • Validity Window: Tokens remain valid for 48 hours from the moment of dispatch (DEFAULT_EXPIRY_HOURS = 48).
  • No-Response Threshold: If the buyer has not interacted with the link after 24 hours (DEFAULT_NO_RESPONSE_HOURS = 24), the lead status automatically flags for follow-up.
  • Background Cron Engine: A background scheduler runs every 15 minutes (*/15 * * * *) executing processExpiredBookings and processNoResponseBookings, updating lead timeline events and notifying the assigned sales rep.

Lifecycle Statuses​

  1. DRAFT: Link generated inside the Lead Workspace, awaiting dispatch.
  2. SENT: Link delivered to the prospective buyer via SMS, WhatsApp, or Email.
  3. OPENED: Automatically tracked when the prospective buyer accesses /booking/[token]. (Staff visits authenticated in the CRM do not trigger this status).
  4. BOOKED: Buyer successfully selects and confirms a reservation slot.
  5. NO_RESPONSE: 24 hours elapsed without buyer interaction.
  6. EXPIRED: 48 hours elapsed without booking.
  7. CANCELLED: Appointment explicitly cancelled by either the customer or the dealership.

Prospective Buyer Booking Workflow​

Step 1: Accessing the Landing Page​

The customer taps the link received via SMS or WhatsApp: https://app.steer.ai/booking/<token>. The page loads without requiring any login or app installation. Rate limiting applies to safeguard the endpoint against automated abuse (120 requests per 5 minutes per IP:token).

Step 2: Vehicle & Dealership Verification​

The booking interface presents an interactive vehicle summary card:

  • High-resolution hero photo of the target car.
  • Make, Model, Version, Year, Powertrain, and Gearbox.
  • Dealership branch address, operating hours, and sales advisor contact details.

Step 3: Interactive Calendar Slot Selection​

  • The customer browses live appointment slots aligned with dealership availability and normalized to the dealership's local timezone.
  • Conflict Prevention: If another customer books a selected slot simultaneously, the API responds with HTTP 409 SLOT_UNAVAILABLE and presents immediate alternative openings.

Step 4: Contact Details & Confirmation​

  • The customer confirms their name, mobile phone number, email address, and optional trade-in vehicle comments.
  • Submitting the form confirms the slot, synchronizes with the dealership master calendar, creates an internal task for the sales advisor, and returns a confirmation screen with calendar file (.ics) download links.

Rescheduling & Cancellation​

Customers can reopen the same booking link at any time prior to the scheduled appointment to choose a different time slot or cancel the visit.