Stave 2.0 Guide

Getting in

Everyone signs in at admin.stave.works. There is no public sign-up. A Stave admin adds a business and its first owner, and owners invite the rest of their team.

Signing in

• Password. Enter your email and password and press Sign in.
• Email link. Press Email me a link instead. Stave emails a one-time sign-in link to addresses that already have an account. Unknown addresses get nothing.
• Forgot your password. Enter your email and Stave sends a reset link that works for one hour. This also works for someone who has never set a password, for example an owner who came across from Stave 1.0.
• Invitations. An invite email opens /invite/<token>. Someone new enters their name and Stave emails them a sign-in link. Someone with an account already signs in and accepts. Either can add a password later with Forgot your password.

Who can do what

After signing in, people land on their business at /b/<slug>, for example /b/grv. Someone who belongs to more than one switches with the business name at the top of the sidebar.

The business admin

The sidebar only shows what a business uses. A Stave admin switches sections (Blog, Wines, Events and so on) and plugins on per business, and screens for anything switched off disappear. Screens marked Owner are hidden from members.

Home

/b/grv

The first screen after signing in. It shows when the site was last published and how many pages have changes waiting, shortcuts to write a post, add an event, add a wine or upload photos, a Needs your attention list (unpublished pages, new club requests, open review notes, connectors that stopped working), what's coming up and recent activity.

The whole admin works on a phone. The sidebar folds into the menu button at the top left.

Messages

/b/grv/messages

Everything sent through forms on the site. Stave also emails each message to the business. Form settings sets which address gets new messages and what the automatic reply to the sender says.

Pages

/b/grv/pages

Every page on the site with its address, when it was last edited and whether it has unpublished changes. Click a page to edit it. Use New page to add one, and the ⋯ menu on a row to duplicate or delete one.

Editing a page

/b/grv/pages/<id>

1. The left column lists the sections on the page (hero, hours, featured products and so on). Drag to reorder, or use Add section. The site header and footer are shared by every page and edited under Site settings.
2. Click any section in the preview to edit it. Its text becomes editable where it sits.
3. The right column holds the page settings: name, web address, the title and description search engines show, and a preview of how the page looks on Google.
4. Changes save as a draft automatically. Use the desktop, tablet and phone buttons at the top to check sizes, and undo or redo from the same bar.
5. Press Publish when it's ready. Nothing changes on the live site until then.

Site settings

/b/grv/site

The header menu, footer and other settings shared by every page. Reorder menu items with the arrows, open one to change its label or link, then Save draft or Publish.

Redirects

/b/grv/redirects

Send an old address to its new home, so old links and search results keep working. Add one when a page moves or a new site replaces an old one. Choose permanent (308) for moves that stick and temporary (307) for anything short-lived. Stave applies them on the business's own domains, and client sites hosted elsewhere look them up through the redirects API.

Review notes

/b/grv/notes

Comments pinned to a spot on a page, shared between the business and Stave while a site is being reviewed. Open the site while signed in and use the Review button to drop a note on any element. Notes have a kind (design, copy, bug, question, idea), a priority and a status (open, in progress, resolved). Visitors never see the button or the pins.

Site health Owner

/b/grv/health

Scores for how the site does with AI assistants, search engines and speed, each with the findings behind it: what needs a fix and what's already working. A Stave admin sets how often the checks run.

Board

/b/grv/board · TV address /t/grv/board

The menu for the TV in the tasting room. Open the TV address in the TV's browser and leave it. It updates itself and never needs a login.

• What shows: everything that's pouring, or only the drinks you pick.
• Tastings and flights: board-only items that aren't wines or beers.
• Banner: one line that scrolls across the top. Leave it empty for no banner.
• Prices and sizes: select several drinks and give them the same sizes and prices in one step.

Posts, wines and beers

Posts

/b/grv/posts

The blog. Tabs split drafts, scheduled and published posts. Write a post opens the editor.

• Set a cover photo, a title and the body. The toolbar handles headings, bold, italic, quotes, lists and links, and can drop in a wine, an event or a photo.
• The side panel holds the web address, categories, a short summary (160 characters for search results), the byline and a Google preview.
• Publish now, or pick a time from the publish menu. Scheduled posts go live at the top of the next hour after their time.

Wines

/b/grv/wines

The wine list. Changes show on the site right away, with no publish step. Prices and stock also feed the shop. Use the arrows to set the order wines appear in, and the status to mark a wine on the menu or sold out. When Vinoshipper is connected, its catalog sync keeps wines in step.

Beers

/b/grv/beers

Guest beers poured in the tasting room, grouped by style. They show on the TV board and the tasting room menu and aren't sold online. The toggle on each row puts it on or takes it off the board. Breweries using Untappd can sync their menu instead of typing it.

Events and ticket sales

Events

/b/grv/events

Upcoming and past events. With Facebook Events connected, events from the Facebook Page come in every 8 hours, including changes and cancellations. Check Facebook now pulls them immediately. Add an event creates one by hand.

Ticket sales

/b/grv/tickets

Tickets sold, ticket money, events on sale and orders waiting for payment, then every upcoming event with its sales. Paid tickets need Stripe or Square connected. Without one, guests can only get free tickets.

1. Press Set up tickets on an event.
2. Add a ticket type with a name, a price (zero for free RSVPs), a description and how many are available.
3. The Sales card shows whether guests can buy. Turn sales off stops new orders without hiding the event.
4. The Guests tab lists ticket holders, and Orders lists orders with refunds.
5. On the night, staff open /scan on a phone, signed in, and scan each ticket's QR code to check guests in.

Guests buy on /t/grv/tickets/<event> and get an order page, a ticket page per ticket with a QR code, and an Apple Wallet pass when Wallet is configured.

Shop and media

Shop

/b/grv/shop

What the site's shop sells and where orders go. For a winery on Vinoshipper, guests pick wines on the Shop page and check out in Vinoshipper's cart. Vinoshipper takes the payment, checks age and ships, and Stave doesn't get a copy of those orders. Sync now pulls the catalog. Event tickets are separate and live under Ticket sales.

Media

/b/grv/media

Upload once and use anywhere on the site. Drop JPG, PNG or WebP files up to 4.5 MB on the page or press Upload. Stave resizes them for fast loading. Filter by photos or bottles, and use Needs a description to find images missing alt text.

Contacts and wine club

Contacts

/b/grv/contacts

Everyone who signs up on the site lands here, and Add contact adds someone by hand. Search by name, email or phone and filter by where they signed up or email status. The Texts column shows who opted in to text messages. Text opt-in needs a phone number and a date of birth showing the person is 21 or older.

Wine club

/b/grv/club

Three tabs: Requests from people asking for a place on the list, Members and Tiers. Changing a request's status (new, invited, declined) sends nothing, so write to the person yourself. Members join a tier through the site and get a private page at /club/manage/<token> to pause, skip a shipment, switch between pickup and shipping, update their address or cancel.

Reservations

/b/grv/reservations · settings /b/grv/reservations/settings

Tasting room and visit reservations made from the site, with party size and notes.

Open Reservation settings to take bookings:

• Take reservations on your site turns the booking page on. When it's off, the page tells people reservations aren't open.
• Confirm right away confirms and emails the guest while the time has room. Turn it off to review each one as a request.
• Largest party the form accepts. Bigger groups are told to get in touch.
• Days and times sets which slots can be booked and how many seats each holds. Nobody can reserve until at least one exists.

Guests get a confirmation email with a link to add the visit to their calendar, and a reminder email on the morning of the visit.

Text messages Owner

/b/grv/sms

Marketing texts sent from the business's own Telnyx account and number, only to people who opted in. A Stave admin turns on the Text messages plugin first. That adds this screen and unlocks the Telnyx connector.

1. Connect Telnyx (see Setting up Telnyx).
2. Press New text. Give it a name, write the message and check the preview.
3. Under Who gets it, pick contact tags or everyone. Only people who opted in are counted.
4. Leave Schedule empty to send now, or pick a time. Press Schedule, or Save draft to finish later.
5. Stave sends due texts every five minutes and keeps per-campaign delivery counts. STOP and HELP replies are handled for you.

Stays and guest guides

Units

/b/grv/units

The places guests can book, with photos, sleeping details, rates and rules for the stay page. Each unit has a booking link. If it's set, the site's Book button sends guests there (Airbnb, VRBO). Clear it and guests use Stave's own request form.

Bookings

/b/grv/bookings

A month calendar per unit showing stays booked through Stave, requests that need a reply and stays pulled in from outside calendars. Stave reads each unit's Airbnb or VRBO calendar every two hours, and publishes its own feed at /api/stays/ical/<token> so those sites can block the same dates. Add booking enters one by hand.

Guides

/b/grv/guides

What guests read once they've booked: door code, wifi, house manual and local favorites. Each guide has a private link (/g/<token>) that never changes, so a printed QR code keeps working. Only people with the link can see it.

Business info and team

Business info Owner

/b/grv/business

Hours, address, phone, email and social links. These show on every page of the site, in the business's Google listing data and in what AI assistants say about it. Hours lines can be days, date ranges or words like "By appointment". Press Save when done.

Team Owner

/b/grv/team

People who can sign in to this business. Invite someone emails an invite as owner or member. Pending invites can be resent or revoked, and existing people can be changed between roles or removed. A business always keeps at least one owner.

Connected services Owner

/b/grv/connectors

Link the outside services a business already uses. Only owners and Stave staff can open this screen. Keys and tokens are stored encrypted and can never be read back. Leaving a key field empty keeps the saved one.

Services fall into three groups:

• Pulls your information in: Facebook Events, Untappd, Vinoshipper, Telnyx and Square. Each has a sync that runs on a schedule and a button to run it now.
• Works on your site: Stripe and Google Analytics, used directly by pages and checkout.
• Saves your keys only: Google Business Profile, Mailchimp, Commerce7, WineDirect, Toast, Arryved and Ollie. You can save keys and mark these on, but Stave doesn't talk to them yet.

Setting up any service

1. Press Set up on the service. A panel opens on the right.
2. Fill in the fields. Each one says where to find the value in the other service.
3. Tick the capabilities you want, where the service has them.
4. Turn it On and press Save.
5. Press Check credentials to test the keys, then Sync now for services that sync. The row shows when it last synced and why, if it failed.

Turning a service off stops it syncing and being used, but keeps the saved details. Disconnect deletes them.

Setting up Telnyx

Telnyx sends the business's marketing texts from its own account, so Stave never pays for or owns the number.

1. Stave turns on Text messages. A Stave admin opens the business under Businesses, Sections and plugins, and switches on the Text messages plugin. Telnyx then appears under Connected services.
2. API key. Telnyx portal, Account, API keys. Paste it into API key.
3. Messaging profile. Telnyx portal, Messaging, Messaging profiles. Copy the ID of the profile the number belongs to.
4. Send from. With the key saved, press Load list and pick the number, or type it as +1XXXXXXXXXX.
5. Webhook public key. Telnyx portal, Account, Keys and credentials, Public key. Without it Stave refuses STOP replies, because anyone who found the webhook address could otherwise opt contacts in and out.
6. 10DLC campaign ID. The registered campaign the number sends under. US carriers quietly filter unregistered marketing texts, so a send can look successful and never arrive. Registration happens in Telnyx.
7. Webhook address. In the Telnyx messaging profile, set the inbound webhook to https://admin.stave.works/api/connectors/telnyx/webhook/<business id>. Golden Road's business id is 4.
8. Tick Marketing campaigns, turn it On, Save, then press Check connection. It warns about a missing 10DLC campaign ID, a number that isn't active or a missing messaging profile.

Every service

Pages guests use

The client's own website (grvwines.com for Golden Road) shows the content. A few guest pages are served by Stave itself, and the client site links to them.

Stave staff tools

Stave admins get a second sidebar at /stave: Overview, Businesses, Users, Change log, Audits and Leads. Two-factor sign-in is required before any of it opens.

Businesses

/stave/businesses

Every business with its domain, theme, sections and status. Open as owner jumps into its admin. Add a business asks for a name, slug, domain and theme.

Opening a business shows six tabs:

Users and View as

/stave/users

Everyone who can sign in, the businesses they belong to, their Stave role, whether two-factor is on and when they last signed in.

View as opens the admin exactly as that person sees it, with their role and sidebar, so you can reproduce a problem they report. A banner stays at the top while you're viewing. Stop viewing returns you to your own account.

Every change made while viewing as someone is recorded in the Change log (/stave/log) with who did it, who they were viewing as, the business, the change and a diff.

Audits and leads

/stave/audits · /stave/leads

Audits lists AI visibility and site speed reports. Run an audit starts one for a business. Nothing goes to the business until you publish it. Published reports are served at stave.works/reports/<slug> behind an access code. Reports produced on another machine are uploaded through the audit import API.

Leads come from the free audit and the contact form on stave.works. Set each one's stage as it moves along.

API

All endpoints live on the admin host, https://admin.stave.works/api/…. Requests and responses are JSON unless noted. Errors come back as { "ok": false, "error": "…" } with a matching status.

How calls sign in

For bearer endpoints, a wrong secret returns 401 and an unset one returns 404, so a missing environment variable doesn't look like a working endpoint.

Public forms use two bot fields. hp is a hidden honeypot that must stay empty. t is the time the form was shown, in milliseconds since the epoch, and a submit under 2.5 seconds later is treated as a bot. A caught request gets a fake success so bots learn nothing.

Site content

curl -s "https://admin.stave.works/api/site-content?tenant=grv" \
  -H "Authorization: Bearer $SITE_CONTENT_SECRET"

Forms and sign-ups

Bookings and orders

Payments

Confirm endpoints allow 30 calls per 10 minutes per IP and 10 per order.

Connectors

All of these except the webhooks and the Facebook callback need an owner's session, with the business slug as tenant in the body (or the query for GET).

Admin and machine

Scheduled jobs

Vercel cron calls these with CRON_SECRET. Times are UTC.

Each sync covers every active business with that connector turned on, and records the result on the connector's row in Connected services.

Running Stave

Code flows development → stage → main through pull requests on OneNomad-LLC/stave-cms-2. Every other branch is skipped by Vercel. Database migrations run as part of each build.

Environment variables

Names only. Values live in Vercel and the password vault.