Home / Auto Repair / After-hours drop-off check-in: a QR form at the key drop that creates the Shopmonkey order
Auto Repair problem 5: After-hours drop-offs arrive as a key in an envelope with a phone number scrawled on it
After-hours drop-off check-in
A QR form at the key drop that creates the Shopmonkey order
A short form (linked from a QR code at the key drop) asks for name, mobile, email, year/make/model, plate, what's going on with the car, where the key is, and optional text consent. Shopmonkey gets the customer (found by phone, or created) and an order named 'Drop-off: vehicle' with the complaint, key spot and plate. The customer gets a confirmation email and, with consent, a text (after 9 p.m. it waits for 8 a.m.) saying an advisor will call or text with an estimate before any work. The advisors get an email for the morning. If Shopmonkey fails, the email says 'NOT in Shopmonkey, add by hand' with every detail.
How the workflow runs
Trigger · When an event arrives
Form submit (POST)
Steps
- Honeypot + form key + dedupe
- Shopmonkey customer + order, compose
Outcome
- Answer the browser
- Send confirmation + office email
Also runs on: Form page (GET) → Render form → Send form page
Also runs on: Every 15 min, 8 am-8 pm → Send held texts → Send held
Drawn from the node names in the workflow file inside the download (workflow.json).
The problem
We found no public figure on after-hours drop-offs. The closest numbers are vendor-commissioned and about online booking, not drop-offs.
- Tekmetric/Ipsos (vendor-commissioned, Sept 2025): 73% of vehicle owners said they'd likely use online booking. Source: Ratchet+Wrench, Oct 1, 2025: Tekmetric unveils marketing solution (Tekmetric/Ipsos survey of 1,147 vehicle owners, Sept 2025) (Vendor-commissioned survey)
- AutoZone's May 2025 survey points the other way for appointments: 67% preferred to book by phone, 28% online. A drop-off form doesn't replace the phone; it captures the details when nobody is there to answer. Source: AutoZone / Endeavor Business Intelligence: Automotive Repair Shop Owners and DIFM Customers (May 2025) (Industry survey)
Background reading: Car-ready text templates for auto shops (and two you shouldn't send)
Who it's for
Shopmonkey shops with a key drop box or night drop.
Tools and monthly cost
| Tool | Official price |
|---|---|
| Shopmonkey (you probably already pay for it) | Basic $239 / month, Clever $399, Genius $499 (about 10% less billed annually: $215 / $359 / $449). The pricing page lists 'API and Webhooks' and unlimited 2-way SMS and email in every plan, and 'Automated Estimate Followups' on Genius. CRM Essentials (campaigns, online booking) is a paid add-on at $349 / month ($314 annual) pricing page |
| Twilio US local phone number | $1.15 / month pricing page |
| Twilio US SMS, sent or received | $0.0083 per segment, plus carrier fees on outbound texts of $0.0035-$0.005 per segment pricing page |
| A2P 10DLC registration (required to text US customers from a local number) | One-time: $4.50 brand registration and $15 campaign vetting. Monthly: $1.50-$10 per campaign by use case pricing page |
| Resend (sends the emails; any email API that accepts an Idempotency-Key works) | Free: 3,000 emails / month, 100 / day. Pro: $20 / month for 50,000 emails pricing page |
| Google Sheets (consent log, opt-out list, declined-work log) | Free with a Google Account pricing page |
| n8n | Community Edition: free if you self-host (you pay for the server). n8n Cloud: Starter EUR 20 / month or Pro EUR 50 / month, billed annually pricing page |
Example month: Illustrative arithmetic, not a measured result. One local number sending 100 single-segment texts and receiving 100 a month, at the highest listed carrier fee ($0.005): 100 x ($0.0083 + $0.005) + 100 x $0.0083 + $1.15 number = $3.31 a month in Twilio usage, plus the A2P 10DLC campaign fee ($1.50-$10 a month) and one-time registration ($4.50 brand + $15 campaign vetting). Emails stay inside Resend's free tier at this volume. n8n and your Shopmonkey plan come on top. Your volumes will differ.
Setup
- Shopmonkey: create an API key (Settings > Integration > API Keys) and set SHOPMONKEY_API=https://api.shopmonkey.cloud/v3 and SHOPMONKEY_API_KEY. The workflows send it as a Bearer token and honor HTTP 429 Retry-After.
- Texts need a Twilio number on an approved A2P 10DLC campaign. Set TWILIO_ACCOUNT_SID, TWILIO_BASIC_AUTH (base64 of SID:auth token) and AUTO_TWILIO_FROM.
- Email: MSS_EMAIL_API (e.g. https://api.resend.com), EMAIL_API_KEY, AUTO_EMAIL_FROM, AUTO_OFFICE_EMAIL (the service advisors' inbox). Every send carries an Idempotency-Key, so a retried run never emails twice.
- Company details: AUTO_COMPANY_NAME, AUTO_COMPANY_PHONE, AUTO_COMPANY_ADDRESS, COMPANY_TZ (the shop's time zone; texting hours follow it).
- Google Sheet stand-in: MSS_SHEET_URL points at the shared sheets (sms_consent, sms_optouts, inbound_texts and the recipe's own sheets). In production, swap these HTTP calls for n8n's Google Sheets node.
- Remove the test-only mss-ar*-tick webhooks (or put them behind n8n header auth) and make sure MSS_TEST_CLOCK is NOT set in production.
- Print a QR code that opens /webhook/mss-ar5-checkin (or copy the form HTML into your website and post to the same URL; keep the form_ts / form_key fields).
- AUTO_FORM_HMAC_SECRET signs the form key; AUTO_FORM_MIN_SECONDS (default 3) is the minimum fill time.
- The consent checkbox text is stored with time, IP and browser in the sms_consent sheet, which the car-ready recipe also uses. Have your attorney review it. Consent isn't required to drop off a car, and the form says so.
Download
Downloadauto-after-hours-dropoff-checkin.zip
Contains the n8n workflow, the mock data, the test runner with its last results, and the mock server we tested against. All keys in .env.example are fake.
Test result
Every workflow was imported into n8n 2.45.4 on an isolated test instance and run end to end. Shopmonkey (REST v3 with a Bearer key, HTTP 429 with Retry-After, HMAC-signed webhooks), Twilio, the email API (Resend-style) and Google Sheets were replaced by a local mock server built from the vendors' public docs. A frozen test clock checks the 8 a.m.-9 p.m. texting window. These recipes use no AI model; every decision is a written rule. Customers, vehicles and repair orders are invented. Verified with mocks; nothing was sent to a real person or account. How we test.
15/15 scenarios passed (run 2026-10-31)
| PASS | AR5-01 | Form page: signed key, honeypot, vehicle/plate/concern/key fields, 'estimate before any work', optional consent |
| PASS | AR5-02 | New customer at 7:40 pm with consent: Shopmonkey customer (type Customer) + order with complaint, key spot and plate; text + email; consent logged; advisors emailed |
| PASS | AR5-03 | Same phone + vehicle again 5 minutes later: 'already checked in', nothing created |
| PASS | AR5-04 | Same person, second car: accepted (another order on the same customer) |
| PASS | AR5-05 | Existing Shopmonkey customer, no consent: found by phone (no duplicate customer), order created, email only |
| PASS | AR5-06 | Check-in at 10:30 pm: order + email + office now, text held; not at 7:45 am, sent at 8:00 am |
| PASS | AR5-07 | Number that texted STOP before ticks the box: no text (opt-out wins), email still sent |
| PASS | AR5-08 | Honeypot filled: normal-looking thanks, nothing created or sent |
| PASS | AR5-09 | Forged form key: 400, nothing created |
| PASS | AR5-10 | Form posted in under 3 seconds: treated as a bot |
| PASS | AR5-11 | Missing phone and concern: 400 with a plain explanation |
| PASS | AR5-12 | Name with markup is escaped on the thank-you page |
| PASS | AR5-13 | Shopmonkey down: customer still gets the thank-you, email and text; advisors get every detail and 'NOT in Shopmonkey, add by hand' |
| PASS | AR5-14 | Shopmonkey 429 once: Retry-After honored, one customer and one order |
| PASS | AR5-15 | Twilio 429 once: text sent exactly once |
Actual output from the test run
Scenario AR5-02: the check-in confirmation text after an evening drop-off (invented customer and shop). Names and numbers are invented.
Hi Tess, Riverside Auto Care has your 2016 Toyota RAV4 checked in. A service advisor will look at it when we open and call or text you with an estimate before any work is done. Reply STOP to opt out.
Verified with mocks
- Form page: signed key, honeypot, vehicle/plate/concern/key fields, 'estimate before any work', optional consent
- New customer at 7:40 pm with consent: Shopmonkey customer (type Customer) + order with complaint, key spot and plate; text + email; consent logged; advisors emailed
- Same phone + vehicle again 5 minutes later: 'already checked in', nothing created
- Same person, second car: accepted (another order on the same customer)
- Existing Shopmonkey customer, no consent: found by phone (no duplicate customer), order created, email only
- Check-in at 10:30 pm: order + email + office now, text held; not at 7:45 am, sent at 8:00 am
- Number that texted STOP before ticks the box: no text (opt-out wins), email still sent
- Honeypot filled: normal-looking thanks, nothing created or sent
- Forged form key: 400, nothing created
- Form posted in under 3 seconds: treated as a bot
- Missing phone and concern: 400 with a plain explanation
- Name with markup is escaped on the thank-you page
- Shopmonkey down: customer still gets the thank-you, email and text; advisors get every detail and 'NOT in Shopmonkey, add by hand'
- Shopmonkey 429 once: Retry-After honored, one customer and one order
- Twilio 429 once: text sent exactly once
- Verified with mocks; invented customers, vehicles and repair orders only.
Documented from official API docs only
Built to the vendor's documentation but not run against a live account. Check these on yours.
- Shopmonkey REST v3 paths, field names (order, customer, deferred services, workflow status) and webhook signing (webhook-signature 'v1,' base64 HMAC-SHA256 of id.timestamp.body) come from Shopmonkey's public developer docs; not run against a live Shopmonkey account.
- Twilio request signing, Messages API, Dial action callbacks, 429 behavior and built-in STOP handling (from Twilio's docs). The email API follows Resend's documented request shape.
Limitations
- The order is created with the complaint as the customer wrote it; the vehicle still has to be attached in Shopmonkey (the advisor email says so). The create-customer and create-order request bodies follow Shopmonkey's documented schema but were not run against a live account.
- The honeypot and form key stop simple bots, not a determined person. The same phone and vehicle within 10 minutes counts as a duplicate.
- Every message is checked against a word list first (AUTO_LINT in autolib.py): 'guaranteed', 'safe / unsafe to drive', 'dangerous', 'will fail', 'diagnosis', storage fees and collection threats are blocked, and the office is told instead. A text can't see the car; a technician's words belong in the estimate, not in an automated message.
- Written and tested for Shopmonkey's API only. Tekmetric's API isn't open to the public, and Mitchell 1, Shop-Ware, AutoLeap and other shop systems are not built; we make no claim these recipes work with them.
- Not legal advice and not a compliance guarantee. Texts to customers go only to numbers with consent recorded on our check-in form (or that just called the shop, for the missed-call reply), only between 8 a.m. and 9 p.m. shop time, and plain-English opt-outs are honored (47 CFR 64.1200 is the federal rule we design around). Some states are stricter; have your attorney review texting consent before going live.