Getting started

Quick checklist for returning users. First-time setup walkthrough lives in Installation.

1. Register at /register with username, email, password (12+ characters).
2. Verify your email by clicking the link.
3. Wait for an admin to activate your tenant. You will be notified by email.
4. Sign in. Open Integration in the sidebar.
5. Set the Webhook URL pointing at your DHRU callback endpoint, e.g. https://yourdhru.com/modules/gateways/callback/triapay.php.
6. Rotate the API key and Webhook secret. Both are shown only once — copy them immediately.
7. Download the two plugin files from the same Integration page:
   • triapay.php → drop into modules/gateways/ on your DHRU server
   • triapay-callback.php → rename to triapay.php and drop into modules/gateways/callback/ on your DHRU server
8. In DHRU admin, enable the TriaPay gateway and paste your TriaPay API URL, API key, and webhook secret.
9. Configure receive methods (master wallet addresses for TRC20/BEP20, Pay ID for Binance Pay) under Crypto and Binance Pay tabs.
10. Send a $1 test deposit from a DHRU customer account. Confirm the order goes pending → matched → credited within seconds (typical detection latency 3–7 s plus chain confirmation).

Detection latency

End-to-end credit usually takes well under a minute. The dominant variables are chain confirmation and the polling tick that scans for matches.

Chain	Polling tick	Typical end-to-end
TRC20	3 s	3–7 s
BEP20	3 s	3–7 s
Binance Pay	5 s	5–10 s

These numbers exclude wallet broadcast time on the customer side. The polling cadence above is the listener's own scan rate; matched orders move to credited as soon as the webhook acknowledges. BSC eth_subscribe push and Binance Pay merchant-webhooks are on the roadmap for sub-second detection but are not shipped.

Login security

Sign-in flows through /auth/login with the following OTP options:

• Email OTP (default).
• WhatsApp OTP, available when a phone number is set on the profile.
• TOTP step-up bypass when 2FA is enrolled.

A "remember this device" cookie (7-day expiry, bound to the browser fingerprint and the /24 IP class) skips OTP on subsequent logins from the same network class. Revoke individual devices anytime from /me/devices.

Testing with sandbox mode

Sandbox mode lets you exercise the full order → webhook → DHRU round-trip without touching real chains, real funds, or your real DHRU invoices. Use it whenever you change the plugin config, rotate a key, or move DHRU to a new host.

One-time setup

1. Dashboard → Integration tab → API Key card → switch to the Sandbox tab → click Generate sandbox key. Copy the tpk_test_... value.
2. Same card, Webhook Secret subsection → Sandbox tab → Generate sandbox secret. Copy the value.
3. In DHRU admin → Setup → Payment Gateways → TriaPay, paste the sandbox key into API Key (Sandbox) and the sandbox secret into Webhook Secret (Sandbox).
4. Tick the Sandbox Mode checkbox in the same form. Save.

Trigger a test payment

1. Dashboard → API Playground → switch the mode toggle to Sandbox (banner appears confirming sandbox is active).
2. Run Create order with any chain/asset combination. Copy the returned idempotencyKey.
3. Run Force credit with that idempotency key. The simulator dispatches the webhook through the same crediter path used in production.
4. Verify your DHRU server receives the POST with X-Payment-Mode: sandbox (check error_log).

Your DHRU plugin's callback handler short-circuits sandbox webhooks automatically — it logs the event, returns 200 OK, and never calls addPayment. No live invoice is credited, no tblUsers.credit_left row changes.

When you are ready to switch to real traffic, untick Sandbox Mode in the DHRU admin form. The live API key and live webhook secret stay where they were; nothing else needs to change.