The console

The console is the browser side of the gateway: where your people configure the integration, find a transaction a customer is asking about, and pull figures for the books. Your developers use the API; everyone else uses this.

Signing in the first time

Moria creates your first user and hands you the password out of band. That password is one somebody else chose and knows, so the console will not let you do anything else until you replace it — every page except your account is closed until you do.

The new password must be at least eight characters with an upper-case letter, a lower-case letter, a number and a symbol. Changing it signs you out everywhere, which is what “I changed my password” ought to mean; sign back in with the new one.

Before you can take a payment

Ringkasan shows what is still outstanding, and disappears once it is all done. Four things have to be true:

Step	Who does it
Payment account provisioned	Moria
Business verification complete	You, via the provider’s form
An API key created	You
A delivery address set	You

Each row links to the page that fixes it. Rows waiting on Moria say so, so you are not left looking for a button that is not yours to press.

The pages

Ringkasan — balance, currently available funds, pending settlement, today’s volume, and the payment account’s status.

Pembayaran — money in. Every payment, with one partner-facing fee alongside the gross and net amount. Moria keeps the provider/margin split internally.

Pencairan — money out, plus your payout limits and how much of them is left today. If a payout is refused for exceeding a limit, this is where you see the limit it hit.

Mutasi — the partner-facing ledger. Every movement behind the balance. Internal fee and margin entries without a partner balance direction are not exposed.

Organisasi — the co-operatives under you, with money attributed to each. A partner is an umbrella; this is how each one reconciles separately.

Webhook — every delivery attempt, its response, and a resend button. The delivery address lives one click away, on its own page, along with the test button. Your signing secret is issued from there too; it is shown once, and there is no screen anywhere that can show it again.

API Key — which keys exist, what they can do, when each was last used and from where. Values are never shown after creation.

Dokumentasi — this section.

Pengguna — who can sign in.

Akun — your own name, email and password.

Finding one transaction

Someone calls saying they paid. Search on Pembayaran or Pencairan matches:

Moria’s reference
your own reference — the external_ref you sent, usually the only one the caller is holding
the provider’s order id
the payment code the customer was given

It does not match beneficiary names or account numbers: those are encrypted at rest, so a search over them would match nothing and read as “this transaction does not exist”, which would be worse than not offering it.

Combine it with the date range to narrow a busy day.

Exporting for the books

Unduh CSV on Pembayaran, Pencairan and Mutasi. The file carries exactly what the table is showing — the same filters, the same rows — so what you forward matches what you looked at.

Amounts are written as plain four-decimal numbers with no thousands separator, deliberately: a separator or a localised decimal comma gets re-read by the spreadsheet as a different number, which is the kind of silent corruption an accounting export cannot have.

Payout exports do not include beneficiary names or account numbers. A file is the one thing that leaves our systems entirely: it gets emailed, forwarded, and left in a Downloads folder.

Pengguna lists your people and lets an owner close someone’s access immediately — no approval, no phone call. Somebody leaves today; their access ends today. It takes effect on the next request they make, not when their session happens to expire.

Two things you cannot do, both because they would lock you out of your own account:

suspend yourself
suspend the last active owner

Creating a user still needs Moria’s approval. Raising someone’s access is a different act from removing it: you submit a request from this page, and it becomes an account only once Moria agrees. Moria may approve a lower role than you asked for.

Role	Can
Pemilik (owner)	Everything, including keys, the callback address and users
Operator	Day-to-day: read transactions, resend webhooks
Pembaca (viewer)	Read only

What you see in the interface is presentation, not security — the API re-checks permission on every call, so a hidden button is never the only thing standing in the way.