For operators
Why is a button asking me for a code?#
The action needs a second factor verified in the last five minutes. Enter the six digits from your authenticator and the action retries. Eight actions are gated this way: connecting or rotating a provider, minting a key, changing the team, publishing a policy, approving and releasing a payout, approving a beneficiary change, requesting Live. Roles and guards.
Why does it say I cannot approve something I requested?#
Dual control. The person who asks can never be the person who approves: publishing a policy, approving a beneficiary change, approving a payout above the threshold, creating a live connection. Give the approval id to a second person with the approve permission.
I connected Stripe and it refused my key.#
Read the code it named. LIVE_KEY_IN_TEST_ENVIRONMENT: you pasted a live key; create one in Stripe's test mode. SECRET_KEY_NOT_ALLOWED_USE_RESTRICTED: you pasted sk_test_; create a restricted key with Write on PaymentIntents, Charges, Refunds and Webhook Endpoints. PROVIDER_SCOPE_INSUFFICIENT: add those permissions. Nothing is stored on a refusal. Troubleshooting.
My connection says DEGRADED. Is it broken?#
It still routes. DEGRADED with WEBHOOK_REGISTRATION_SCOPE_MISSING means the Stripe key lacks Webhook Endpoints: Write, so Pehmen could not register its endpoint. Either recreate the key with the permission and re-validate, or create the endpoint in Stripe at the URL the connection shows and paste the signing secret. Connections.
I created a payment and nothing happened.#
Creating and routing are two acts. A new payment sits in CREATED until you press Confirm on its page. Confirming runs the Gate and the router and writes the trace. Payment detail.
Confirm says no eligible route.#
Every connection failed a filter. Open the trace: the matrix shows which filter stopped each one. The usual causes are PayNow with manual capture (PayNow is sale-only), or no active pay-in connection on this merchant account. Reason codes.
The payment is stuck in PROCESSING.#
The connector worker is dispatching it to the provider sandbox. The outcome arrives by the provider's webhook or by the query loop; on a real Stripe sandbox that is seconds. OUTCOME_UNKNOWN means the provider did not answer clearly and the platform is querying on a backoff rather than retrying blindly. Statuses.
What is the difference between EVALUATING, REQUIRES_ACTION and PROCESSING?#
EVALUATING: confirmed and waiting on a Gate decision, or parked by the Gate for a person. REQUIRES_ACTION: the customer must do something (3DS, a QR) or the caller must re-confirm after STEP_UP. PROCESSING: routed, an attempt reserved, being dispatched.
Why does changing a seller's bank account take a day?#
On purpose. A change waits out a cooling-off window (24 hours by default, 72 when the Gate holds it), notifies both the old and the new verified contact, and needs a second person's approval with a fresh code. A hijacked account cannot redirect the next payout in an afternoon. Change a beneficiary.
I just enrolled two-factor and now I cannot approve a change.#
The account-takeover rule: anyone who changed credentials in the last 24 hours, including enrolling two-factor, can neither request nor approve a beneficiary change (ato_session_blocked). Wait, or have someone else act.
What is the difference between approving and releasing a payout?#
Two acts, two permissions. Approving records that a person has reviewed the instruction. Releasing tells the provider to move the money, and it is the only call in the product that does. Above the dual-control threshold, approval needs two different people. Release a payout.
A payout is HELD. What now?#
Read its reason codes; each one is a sentence in the registry. A new destination, a recent change, an amount above the seller's baseline, missing fulfilment evidence or an open case are the usual ones. Resolve the cause (or decide it is acceptable), then approve. A hold is a question for a person, not a failure.
How do I put a rule into force?#
Draft it, validate it, replay it against your own history, submit it, have a second person approve it, then publish with a fresh code. Rollback goes through the same dual control. Nothing is in force until the last step. Publish a policy.
What happens with no policy published?#
Every payment gets ALLOW with POLICY_DEFAULT, and every payout is evaluated against the defaults. The trace and the decision are still written. Publishing a policy is how you make the Gate say no.
What goes in a case?#
A file about a seller, order, payment, payout or change: evidence with a SHA-256 hash and provenance (tombstoned, never deleted), actions such as holding a payout or restricting a seller (each records the state it replaced), and appeals. A seller can appeal through a single-use link without an account. Handle a case.
What is reconciliation for?#
Comparing the provider's settlement report to Pehmen's payout records, by reference and never by amount. Every disagreement becomes a typed exception with an owner, an age and one of four statuses. An amended report supersedes the earlier match and raises an exception rather than silently restating. Reconcile payouts.
Can I invite a colleague with fewer rights?#
Yes. Six roles: owner, admin, approver, analyst, developer, viewer. An approver can approve and release but not connect a provider; a developer can connect and mint keys but not approve. Inviting needs a fresh code. Invite a second person.