Store
Business identity shown on invoices, receipts and support replies.
Payment gateways
Live keys are redacted here — manage secrets in the real environment vault.
Curlec (Razorpay MY)Primary gateway — domestic MYR checkout
Test mode
- Key ID
- rzp_live_●●●●●●●●
- Webhook secret
- Set
- Methods
- FPX · Cards · TNG · GrabPay · ShopeePay
- Recurring
- Cards + TNG + FPX e-mandate
Stripe MYCross-border export orders
- Currencies
- SGD / BND export orders only
- Methods
- Cards only — FPX disabled
- Recurring
- Single-use, no saved mandate
HitPayFallback gateway — off by default
PetWallet top-up packages
Customers buy points with a bonus loading — closed-loop, no cash-out.
| Top-up | Points credited | Bonus |
|---|---|---|
| RM50 | +5% | |
| RM100 | +10% | |
| RM200 | +15% |
Top-up enabledPetWallet visible at checkout and in the customer dashboard
⚖️ Points model — closed loop, no cash-out. Structured as a BNM e-money exemption under Schedule 1; legal opinion on file (ref. D3).
Integrations & APIs
Every external service in one place — keys stored encrypted, health-checked hourly.
| Service | Used for | Key / account | Status |
|---|---|---|---|
| Mailgun | Transactional email — receipts, reminders, payout notices, expiry warnings (per-locale templates) | mg.petdayz.com · key ●●●● | Connected |
| WhatsApp Cloud API | Order + subscription notifications, low-stock alerts to ops | +60 12-589 0618 | Applying — wa.me links meanwhile |
| Curlec (Razorpay) | MY payments + recurring (FPX, cards, TNG, wallets) | rzp_live_●●●● | Test mode |
| Stripe | SG/BN export card payments | sk_live_●●●● | Test mode |
| MyDHL Express | Export labels, tracking webhooks, commercial invoices | MY860●●● | Sandbox |
| EasyParcel | Domestic MY courier booking (phase 2) | — | Planned |
| GA4 + Meta Pixel | Analytics, ads attribution | G-FN41ZG4CF0 | Connected |
| Petdayz REST API | Our own token-scoped API — future mobile app, partner point-exchange, POS sync | 3 active tokens | v1 |
🔌 All inbound webhooks (Curlec, Stripe, DHL, Mailgun delivery events) are signature-verified and logged in webhook_events with replay protection — see docs/03-ARCHITECTURE.md.
Team & roles
Filament users with access to this admin.
| Name | Role | ||
|---|---|---|---|
| Leo | leo@petdayz.com | Super Admin | Edit |
| Ryan | ryan@petdayz.com | Admin | Edit |
| Ops — packer | packer@petdayz.com | Ops · orders only | Edit |
2FA required for adminEnforced on every account with dashboard access
Audit log (rule_versions)
Every rate, toggle and price change is versioned — nothing overwrites silently.
| Change | By | When |
|---|---|---|
| referral.l1 15% → 15% (no-op save) | leo | 11 Jul, 20:14 |
| points.redeem_rate 100=RM5 → pending D11 | leo | 09 Jul, 11:02 |
| subscription.discount 15% → 15% | system seed | 02 Jul, 09:00 |
| stockist.margin 30% | seed | 02 Jul, 09:00 |
| campaign.merdeka scheduled | ryan | 28 Jun, 16:41 |
Danger zone
Destructive actions — every one of these is versioned and 2FA-gated.
Maintenance modeStorefront shows a holding page, admin stays accessible
🔒 Everything here is versioned + 2FA-gated. Purge actions run against staging only — production requires a second Super Admin approval.
🐾 Static preview — the real admin is Laravel Filament v4 (light + dark mode); every card maps to a Filament resource.