Set up as a merchant on Gumza

Before you start

• An email address you can receive a code on. This becomes your login.
• A Kenyan mobile number for the account owner.
• Your business name and the address you dispatch from.

You do not need WhatsApp credentials, a Shopify store or an API key yet. All three are added later from the dashboard, and the store works without them.

Create the account

Go to gumza.ke/signup. The form is four steps and remembers where you were if you reload.

1. Email

   Enter your work email. A six-digit code is sent to it. Codes expire, and there is a short cooldown before you can ask for another.

2. Verify

   Type the code. This proves the address is yours and unlocks the rest of the form — later steps carry a signed token rather than the raw email, so the address cannot be swapped halfway through.

3. Owner

   Your name, mobile number and a password. The password must be at least 10 characters and contain a letter and a number. This account gets the owner role, which is the only role that can invite staff and change settings.

4. Business

   Business name, category, the location you dispatch from, and how you sell today. The sales channels you tick decide what the dashboard offers you next — tick WhatsApp and it will walk you toward the WhatsApp channel, tick online store and it offers Shopify.

Accepting the terms creates the store and signs you in at /onboarding, which is a checklist of what is left.

Check the delivery link

Open Settings → Delivery in the dashboard. The page shows a connection status pill, the Dispatch base URL, a masked API key and a masked webhook secret.

• Connected — nothing to do. Optionally press Test connection to confirm Dispatch still accepts the key.
• Not connected — press Connect delivery. This retries the provisioning call and mints fresh credentials. It is safe to press more than once: issuing an API key is additive, and existing keys keep working.
• Connection error — the last test failed and the reason is printed under the pill. A rejected key usually means it was revoked on the Dispatch side; press Connect delivery to mint a new one.

Pickup details

Still on the Delivery page, set the address riders collect from, a phone number they can call, and drop a pin on the map. The pin matters more than the text: zone matching, the fee schedule and the ETA are all calculated from coordinates. An address with no coordinates still works — the rider navigates by the text — but the quote falls back to defaults instead of your zone.

Add your catalogue

Under Catalog you can add categories and items by hand, or connect a Shopify store and import the products you already sell. See Shopify for the import.

Whatever is in the catalogue is what the WhatsApp bot can sell. An item with no stock is not offered.

Invite your team

Under Users, invite staff by email. Each invitation carries a role, and the role is what the dashboard lets that person do:

Give people the narrowest role that lets them do their job. Roles can be changed later without re-inviting.

Connect WhatsApp

WhatsApp is the storefront, and it is the one piece that needs credentials from Meta. Because a phone number can only be onboarded to one store platform-wide, the credentials are entered by your Gumza operator rather than self-served. Follow WhatsApp credentials — it lists exactly what to collect from Meta and what to send over.

Go live checklist

• Delivery shows Connected and the pickup pin is right.
• Catalogue has categories, items, prices and stock.
• At least one person other than the owner can accept orders.
• WhatsApp channel is active and a test message gets a reply.
• Place one real order end to end and watch it reach DELIVERED.

For developers

Everything above is also an API. Signup is three public calls, rate limited per IP, and the rest of the dashboard runs on a tenant-scoped JWT.

• POST/api/v1/auth/signup/emailSend the six-digit verification code
• POST/api/v1/auth/signup/verifyExchange the code for a signup token
• POST/api/v1/auth/signup/completeCreate the store, the owner and the delivery link
• GET/api/v1/admin/settings/dispatchRead the delivery connection (secrets are masked)
• POST/api/v1/admin/settings/dispatch/linkRetry provisioning on Gumza Dispatch
• POST/api/v1/admin/settings/dispatch/testVerify Dispatch still accepts the stored key

curl -X POST https://gumza.ke/api/v1/auth/signup/email \
  -H "Content-Type: application/json" \
  -d '{ "email": "owner@example.invalid" }'

# → { "success": true, "data": { "email": "...", "expiresInSeconds": 600,
#                                "resendAfterSeconds": 60 } }