Setup & Billplz configuration

Open the Lovable project settings and add these five secrets:

• BILLPLZ_API_KEY — from Billplz → Settings → Account settings.
• BILLPLZ_COLLECTION_ID — the collection you want bills created under.
• BILLPLZ_X_SIGNATURE_KEY — Billplz → Settings → X Signature Key.
• BILLPLZ_API_BASE_URL — https://www.billplz-sandbox.com/api/v3 for testing, or https://www.billplz.com/api/v3 for production.
• APP_PUBLIC_URL — the public URL your customers use to reach this app (e.g. the preview URL, or your custom domain). Billplz uses it to build the callback and redirect URLs.

Secrets are only used server-side. They never reach the customer's browser.

In your Billplz collection settings, set:

• Callback URL: {APP_PUBLIC_URL}/api/public/billplz/callback
• Redirect URL: leave blank in Billplz — this app passes a unique redirect_url per bill that points to /api/public/billplz/redirect?order_code=….

The callback endpoint verifies Billplz's x_signature before marking any order paid. Callbacks are idempotent — replays cannot double-count anything.

1. Go to /auth and sign up.
2. Grant yourself the admin role by running this SQL in the backend (replace you@example.com):

   INSERT INTO public.user_roles (user_id, role)
   SELECT id, 'admin' FROM auth.users WHERE email = 'you@example.com'
   ON CONFLICT DO NOTHING;

3. Sign out and back in. You now see /admin.

1. Open /order?partner_code=DNC001&source=qr on your phone.
2. Fill the form, accept the privacy consent, tap Pay.
3. You are redirected to Billplz. Complete the sandbox payment.
4. Billplz posts to /api/public/billplz/callback. The webhook verifies the signature and marks the order Paid.
5. You land on /order/result. It shows "Payment received".
6. In /admin, open the order, set fulfilment to Shipped and then Delivered, and add a tracking number.
7. Open /admin/commissions. DNC001 now has 1 × RM12 due for that month.

• Switch BILLPLZ_API_BASE_URL to https://www.billplz.com/api/v3.
• Replace all Billplz credentials with your production ones.
• Publish the app so APP_PUBLIC_URL becomes stable.
• Update the callback URL in Billplz to the published URL.

DNC001 to DNC020 are seeded as active. Add more anytime in /admin/partners. Each partner has a copy-ready referral link.