Product surface
Merchant panel
The side menu (not a header tab bar) is the product navigation. Integration Docs in Settings opens /docs in the same tab.
Sign-in
- /pgui/jsp/login — demo merchant
sandbox@mrivory.test/MrIvory#1 - /pgui/jsp/register — creates APP_ID + secret, then hosted onboarding
- Admin
admin@mrivory.test/MrIvory#1— Merchant List, KYC review, and acquirer slots - Older
@reddragonpay.testsandbox accounts still work.
Where credentials live
Settings → My Profile (/pgui/jsp/profile): App ID, Secret Key (masked until Show), Notification/Webhook URL (http(s) only), and staff email / SMS / WhatsApp destinations for captured sales. HASH uses that secret. See HASH and Webhooks.
Processor management
My Profile lists enabled adapters as Card processor 1, Card processor 2, and so on (stable catalog order). Use this processor sets acquirerId. Connect Card processor N is where you paste that processor’s sandbox credentials for this APP_ID. Saved secrets show last 4 only. Hosted / S2S / refunds use those merchant keys; platform env is a demo fallback. Platform admins enable slots on /pgui/jsp/acquirers and can see a Yes/No keys flag. After you assign a processor, open Payment methods to enable or disable shopper methods. See Processors, payment methods, and store plugins.
UAE e-invoicing (Flick ASP)
Same bring-your-own pattern. Paste X-Flick-Auth-Key, participant_id, and sandbox vs live base URL on My Profile (platform fallback on Acquirers). Create Invoice and Invoice Records then offer Submit e-invoice (Flick). Peppol delivery and FTA reporting status appear on the invoice. Keys missing does not break hosted pay-by-link. Mandate: pilot 2026 / go-live 2027. Seller TRN and legal name are never invented.
Billing → Recurring opens a plans table; create/edit is a modal. Sale Report refunds sit under More per row.
Screens this app serves
| Area | Paths |
|---|---|
| Home | /pgui/jsp/index |
| Onboarding | /pgui/jsp/onboard, /pgui/jsp/businessSummary |
| Reports | purchaseReport, failedTransaction, refundReport, settlementReport, captureTransaction (POS report of captured sales), merchantVisibilityReport (MasterCard / VISA sales, refunds, chargebacks) |
| Filter | /pgui/jsp/transactionSearch |
| Chargebacks | /pgui/jsp/viewChargeback (seeded sandbox case; not a scheme API) |
| Invoice / Pay by link | create + search; public pay page posts into hosted checkout. Optional Flick UAE e-invoice when keys are configured |
| Payouts | remit (Mr Ivory remittance outbound), raisePayout, payOutReport — sandbox IBAN plus remittance quote/confirm/status |
| Banking | /pgui/jsp/banking and /pgui/jsp/bankingReturn — Customer → Verify → rail KYC → Funding → Fiat payout on the white-label rail. Missing keys fail closed. Not remittance and not platform KYC. |
| Fund transfer | bankTransfer, fundTransferReport — panel-only, not one of the eight APIs |
| Users | addUser, searchUser (admin role) |
| Two-factor authentication | /pgui/jsp/security — authenticator-app TOTP (optional for merchants; live platform admins see a banner until enrolled). Recovery codes once. Admin can reset a locked-out user. |
| Payment methods | /pgui/jsp/paymentMethods — enable wired methods for hosted checkout |
| Fees | /pgui/jsp/fees — read-only merchant-facing rate card (card MDR/FC plus product fees). Also on My Profile. Only platform admin can edit. |
| Reseller | /pgui/jsp/resellerHome, /pgui/jsp/resellerEarnings — assigned merchants and sandbox earnings from Reseller MDR/FC |
| Merchants (platform admin) | /pgui/jsp/searchMerchant (list), /pgui/jsp/addMerchant, /pgui/jsp/viewMerchant, /pgui/jsp/merchantRateCard — create APP_ID, view, set rates (per processor + product), assign reseller, login as merchant |
Sub-users can be limited to: View Payment Filter, View Payment Reports, Create Invoice, View Invoice, View Chargeback.
Two-factor authentication
Built-in authenticator-app TOTP for merchant and admin panel login (not a paid add-on). After password, enrolled users enter a 6-digit code or a one-time recovery code. Enroll under Settings → Two-factor authentication (QR + manual secret once). On live (RDP_ENV=live), platform admins see a persistent banner until they enroll; set TOTP_ADMIN_ENFORCE=hard to block other pages. Merchants may enroll optionally. Set TOTP_ENCRYPTION_KEY (32-byte hex or base64) before enabling — login fails closed if 2FA is on and the key is missing. SMS and passkeys are later. See docs/ops-totp.md.
Support chat
Logged-in merchant and admin panel pages include a live support chat bubble (bottom right). Support may ask for your Merchant ID (APP_ID) and whether the question is about Sandbox or Live so answers match what you signed up for and which processor keys apply. Ask about payments, processors, onboarding, invoices, or anything else in the panel. Replies appear in the same thread. Never send card numbers or CVV in chat — hosted checkout collects those.
Honest limits
Invoice and pay-by-link are panel features that call the hosted sale path — there is no separate invoice REST API. POS Report is a report, not a Soft POS terminal API. Support chat is panel-only (not on the public holding page).