Getting Started
Sellino - Multi-vendor eCommerce and POS PHP Script with Customer and Seller Apps
Developed By: BugBuild Labs
Welcome to Sellino
Sellino is a complete multi-vendor eCommerce solution with a built-in POS, Supershop & Accounting system — built for real-world retail businesses such as grocery, supershop, pharmacy, fashion and multi-vendor marketplaces. From a single Laravel codebase you get a customer-facing website, a counter POS, an admin panel, and two companion Flutter mobile apps.
This package ships with four products that all share one Laravel backend and database:
- Admin Panel (Web) — this documentation. The Laravel control center for catalog, inventory, orders, POS, accounting, HR and the storefront.
- Website / Storefront (Web) — the customer-facing online shop, covered in the Storefront section below.
- Customer App — a Flutter shopping app for buyers (covered in the Customer App tab).
- Seller App — a Flutter merchant app for store owners/vendors (covered in the Seller App tab).
Key Features:
- Fast POS sales with multi-payment (Cash, Bank, Mobile, Mixed)
- Products with category, brand, attributes & variations
- Purchase, supplier dues, multi-warehouse stock
- Single-vendor or multi-vendor marketplace with commission & payouts
- Area/courier-based delivery charges with delivery-time (ETA) estimates
- Own delivery men (riders) with a rider panel, commission & payroll link
- Pending-order edit & cancel with automatic wallet refunds
- Customer returns, replacements & refunds (wallet / cash / bank)
- Unified inbox (website widget, WhatsApp, Messenger) with rule + AI auto-reply
- Facebook Pixel conversion tracking, configured from settings
- Optional admin approval for seller products & taxonomy
- Push notifications (Firebase) & local/S3 media storage
- Built-in double-entry Accounting (Chart of Accounts & journals)
- Marketing: coupons, flash sales, campaigns, membership, reward points, affiliates, wallet
- HR & Payroll, multi-language, and a dynamic website builder

Server Requirements
Make sure your hosting meets these before installing the web backend. The built-in installer checks every item automatically on its first screen.
| Requirement | Minimum |
|---|---|
| PHP | 8.3 or higher |
| Laravel | 12.x (bundled with the source) |
| MySQL | 8.0 or higher |
| Web server | Apache or Nginx |
| Build tools | Composer, Node.js & NPM |
| SSL certificate | Recommended for production (HTTPS) |
Required PHP extensions
All of these must be enabled — most shared hosts have them on by default:
BCMath Ctype cURL Fileinfo GD JSON Mbstring OpenSSL PDO Tokenizer XML Zip MySQLi allow_url_fopen
Not sure your server qualifies? Open https://yourdomain.com/install — the installer's first step shows a live green/red check of every requirement and extension above, so you know exactly what to fix.
Database Setup (via cPanel)
Create a MySQL database before running the installer.
Step 1 – Login to cPanel:
Open your hosting cPanel (usually https://yourdomain.com/cpanel).
Step 2 – MySQL® Database Wizard:
Search and open MySQL® Database Wizard.
Step 3 – Create Database:
Enter a database name and click Next Step.
Step 4 – Create User:
Add a username and a strong password, then Create User. Save these securely.
Step 5 – Add User to Database:
Grant All Privileges and finish.
✅ Keep these three ready for the installer:
| Credential | Where you enter it |
|---|---|
| Database Name | Installer → Database Details (or DB_DATABASE in .env) |
| Database Username | Installer → Database Details (or DB_USERNAME) |
| Password | Installer → Database Details (or DB_PASSWORD) |
Host: on most cPanel/shared hosting the database host is localhost. Use that in the installer unless your provider says otherwise.
Package Contents & Source Code
Download Main_Files.zip from your CodeCanyon downloads and extract it locally. Inside you will find the full source for all three products, each in its own folder:
| Folder | What it is |
|---|---|
WebSourceCode |
The Laravel backend — Admin Panel, customer Storefront website and the REST API that powers both mobile apps. This is what you install on your server (see Upload & Environment). |
CustomerAppCode |
The Flutter customer app source (buyer shopping app for Android & iOS). Configure it against your server's API — see the Customer App guide. |
SellerAppCode Multi-vendor |
The Flutter seller app source (merchant/vendor app for Android & iOS). Configure it against your server's API — see the Seller App guide. |
All three connect to one Laravel backend and database — install WebSourceCode first, then point each app at its API URL.
Also in the package: this documentation, and the standard CodeCanyon licence & changelog. The .env file is not included — you create it during setup (it holds your private database, mail and payment credentials).
Upload Files & Environment
Step 1 – Upload Application:
Extract Main_Files.zip, open the WebSourceCode folder and zip its contents. Upload that to public_html (or your domain root) and extract it on the server. Point your web root at the public/ folder.
Step 2 – Install dependencies (only if installing manually via SSH — skip on shared hosting where vendor files are already included):
composer install npm install && npm run build
Step 3 – Create the environment file — copy .env.example to .env:
cp .env.example .env
Step 4 – Set core values in .env:
APP_NAME,APP_URLDB_DATABASE,DB_USERNAME,DB_PASSWORD- Mail credentials (for OTP & notifications)
Step 5 – Generate the app key:
php artisan key:generate
⚠ Important: Never skip php artisan key:generate — without a valid APP_KEY, sessions and encrypted data will break. (The web installer does this for you automatically.)
Step 6 – File permissions
The web server must be able to write to these paths — the installer's Permissions step checks each one:
| Path | Why it must be writable |
|---|---|
storage/ | Logs, cache, compiled views and uploaded media |
bootstrap/cache/ | Framework config & route cache |
.env | The installer writes your app key, DB and JWT config here |
Set them from SSH:
chmod -R 775 storage bootstrap/cache chmod 664 .env # If the web server runs as another user (e.g. www-data), also give it ownership: chown -R www-data:www-data storage bootstrap/cache .env
On cPanel (no SSH): use File Manager → right-click → Change Permissions and set 775 on storage and bootstrap/cache, and 664 on .env.
Installation
You can install with the web wizard (recommended for shared hosting) or the command line.
Web installer:
- Visit your domain in a browser — the installer opens automatically.
- It checks PHP version, extensions and folder permissions.
- Fill in the Database Details and create the Administrator Account (fields below).
- Click Install Now to run migrations & seed default data.
What you enter in the wizard
| Field | What to put |
|---|---|
| Database Details | |
| Database Host | localhost on most shared/cPanel hosting (change only if your provider says otherwise) |
| Database User | The MySQL username you created (see Database Setup) |
| Database Password | That user's password |
| Database Name | The database you created |
| Administrator Account (your first admin login) | |
| First Name / Last Name | The admin's name |
| Email Address | Admin login email — you sign in with this |
| Password | A strong admin password |
The web installer also generates the app key and the JWT secret automatically — nothing extra to do. When it finishes, sign in with the admin email & password you just set.
Command line (alternative)
On a VPS with SSH you can install without the wizard:
php artisan migrate --seed php artisan jwt:secret # API & mobile apps use JWT for login
The default seed creates the standard roles/permissions and demo settings; create your admin user with your own seeder or the app's user management after login.
Real-time chat: the live chat feature uses Laravel Reverb. On a local/VPS setup run php artisan reverb:start to enable websockets — see Real-time Chat.
Real-time Chat (Laravel Reverb)
The live chat between customers, sellers and admin runs over websockets powered by Laravel Reverb (a self-hosted server — no paid Pusher account needed). It is optional: the rest of the app works without it, only real-time messages need it running. The same keys are read by the web frontend and by both mobile apps.
There are two ways to set the credentials — the admin panel (no server access needed) or the .env file. A value saved in the panel overrides the matching .env key; leave a field empty and the .env value is used.
1. Admin panel (recommended)
Go to Dashboard → Settings → Realtime (Websocket) (/admin/settings/realtime). Each field shows the current .env value as its placeholder, so you only fill in what you want to change.
| Field | What it is |
|---|---|
| App ID / App Key | Credentials the clients connect with — same as REVERB_APP_ID / REVERB_APP_KEY. |
| App Secret | Server-only secret. It is never displayed back: leave the box empty to keep the current secret, type a new value to replace it. A green Secret saved badge means one is already stored. |
| Public Address (Host / Port / Scheme) | What browsers and the mobile apps connect to — your domain (or websocket subdomain), 8080 in dev / 443 behind HTTPS. Scheme From .env keeps the file value. |
| Server Bind (Bind Host / Bind Port) | Where the Reverb daemon itself listens — normally 0.0.0.0 and 8080. Behind a proxy this stays local while the Public Address points at your domain. |
Saving does not restart the websocket daemon. After an update, restart the Reverb process (e.g. supervisorctl restart reverb) so the new values take effect — and remember the mobile apps still need the App Key compiled in.
2. Environment keys (.env)
These ship in .env.example and act as the defaults whenever the matching panel field is left empty. Change the ID/key/secret to your own values before going live — they must match on the server and the clients.
| Key | What it is |
|---|---|
REVERB_APP_ID | App identifier (any unique string). |
REVERB_APP_KEY | Public key the clients connect with. |
REVERB_APP_SECRET | Private secret (server only — keep it safe). |
REVERB_SERVER_HOST | Address the Reverb process binds to — usually 0.0.0.0. |
REVERB_SERVER_PORT | Port the Reverb process listens on — default 8080. |
REVERB_HOST | Host the browser/app connects to — localhost in dev, your domain (e.g. ws.yourdomain.com or the main domain) in production. |
REVERB_PORT | Public connect port — 8080 in dev; 443 behind HTTPS. |
REVERB_SCHEME | http in dev, https in production (the client then uses secure wss://). |
VITE_REVERB_APP_KEY / HOST / PORT / SCHEME | The same values exposed to the web frontend at build time — they inherit from the keys above, so set the REVERB_* keys and rebuild. |
After changing any VITE_* value you must rebuild the frontend assets: npm run build. The VITE_* keys are baked in at build time, so the admin panel cannot override them — if you change the key/host from the panel, mirror it in .env and rebuild.
3. Run it locally
Start the Reverb websocket server from the project root:
php artisan reverb:start
Leave it running while you use the app; chat messages now appear instantly. (During development you can add --debug to see live connection logs.)
4. Keep it running in production
- Daemonize the server so it restarts automatically — run
php artisan reverb:startunder Supervisor (or systemd/pm2). Example Supervisor program:command=php /path-to-app/artisan reverb:start·autostart=true·autorestart=true·user=www-data. - HTTPS sites: set
REVERB_SCHEME=https,REVERB_PORT=443and put Reverb behind your web server. In Nginx, proxy a subdomain/path to127.0.0.1:8080with the websocket upgrade headers:proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; - Firewall: if you connect directly to the Reverb port (no proxy), open
REVERB_SERVER_PORT(8080) on the server firewall. - Point
REVERB_HOSTat the public host the clients reach (your domain / websocket subdomain), then rebuild the frontend and update the mobile app config.
Mobile apps: the Customer and Seller apps compile the Reverb values into lib/core/env/prod_env.dart (and dev_env.dart for debug builds), so they must match whatever is effective on the server — the panel value if you set one, otherwise .env:
- Customer App —
kReverbAppKey,kReverbHost,kReverbPort(the scheme is derived fromkBaseUrl). - Seller App —
kReverbAppKeyonly; host and scheme are derived fromkBaseUrl.
Queue Worker & Scheduler
Background jobs (emails, push notifications, media variants, backups) run through Laravel's queue, and timed jobs through the scheduler. Both are optional at first — but recommended in production.
- Queue driver —
.envships withQUEUE_CONNECTION=sync(jobs run inline, no worker needed). For production setQUEUE_CONNECTION=databaseand run a worker. - Run the worker —
php artisan queue:work. Keep it alive with Supervisor/systemd (same pattern as Reverb), or on shared hosting usephp artisan queue:work:daemon. - Scheduler — add one cron entry:
* * * * * cd /path-to-app && php artisan schedule:run >> /dev/null 2>&1. - Timed commands —
push-campaigns:dispatch-due(scheduled push campaigns),backup:database/backup:files(see Backups),replacements:flag-stale-sellers,currency:update-rates(nightly FX refresh when daily auto-update is on — see Currency Rates).
After changing QUEUE_CONNECTION or deploying new code, restart the worker: php artisan queue:restart.
Login & Security
The admin login link ends with a randomized security slug (set in config('site.admin_login_path')) so the admin panel is not at a guessable URL.
Login URLs (replace example.com with your own domain):
- Admin:
example.com/admin-7eP9kM4QX2pUoEic/login(slug fromconfig('site.admin_login_path')) - Seller:
example.com/seller/login - Customer:
example.com/login
Log in:
- Open the admin login link, enter your email and password, click Login.
- If two-step verification is on, enter the code emailed to you.
Forgot password: click Forgot password?, enter your email, type the emailed code, then set a new password.
Note: Never share your password. Change it from Profile & Password if anyone else may know it.


Dashboard
The first screen after login — a quick overview of your business.
- Summary cards: today's sales, orders, customers and revenue.
- Charts: sales and revenue trends at a glance.
- Left menu: opens every module, grouped exactly like this guide.
- Top-right menu: your profile, change password and logout.

Dashboard Styles (Admin Panel Look)
The admin panel itself ships with four looks. Open the style switcher from the top navbar — each entry shows a screenshot thumbnail of that style, so you pick by looking, not by guessing from a name.
| Style | What it looks like |
|---|---|
| Default | The original panel look — no extra stylesheet is loaded. |
| New | Refreshed cards, softer surfaces and updated stat tiles. |
| Glass | Glassmorphism — translucent, blurred panels. |
| Sidebar | Redesigned sidebar-led layout. |
- Per user, not per store — the choice is saved in your session and a one-year cookie, so it survives logout and follows that browser. Another admin can run a different style at the same time.
- Nothing else changes — only CSS. Data, permissions and every screen stay identical.
- This is the admin panel look. The customer-facing website and the apps are styled from Web Theme / App Theme.
Developers: styles are listed in config/dashboard_themes.php. A new style = one entry there (label + stylesheet + preview image) — the switcher, the page and the validation all read that one list.

Categories, Brands, Units & Tax
Supporting lists you set up once and reuse on every product. Open the screen, click Create, fill the fields, and Save.
- Categories & Subcategories (Products → Category) — organize products (e.g. Grocery → Rice) and let customers browse. Create the main category first, then pick a parent for subcategories. Each category takes two images: a banner/thumbnail and a small icon — the icon is what the storefront's category strips, mega-menu and the apps' category grid show, so set it on every top-level category.
- Brands (Products → Brand) — manufacturers you sell, with a logo.
- Units (Products → Unit) — units of measure (pcs, kg, litre, box).
- Tax Rates (Products → Tax Rates) — VAT/GST percentages applied at sale.


Products & Attributes
Attributes (Products → Attributes / Attribute Values) are options like Size or Color with values (S/M/L, Red/Blue), used for products sold in variations.
The Products menu is split by source:
- In-House Products — owned by your own shop.
- Seller Products — added by vendors (multi-vendor mode).
- All Products — combined list.
- Deleted Products — recycle bin to review/restore.
Add a product: Products → In-House → Create; fill name, category, brand, unit, price and photos; add a description; enable variations & set their prices; set stock (or manage in Product Stocks); Publish. Use the status switch to show/hide it in the shop.




FAQ, Q&A, Shipping & Barcodes
- Product FAQ (Products → Product FAQ) — questions & answers shown on the product page.
- Product Blogs — articles attached to a product.
- Question & Answer (Reviews → Q&A) — real customer questions you reply to.
- Shipping Partners — couriers that deliver orders.
- Delivery Charges — fees by area/weight.
- Barcodes — generate & print barcode labels to scan at the counter.


Search & Search-by-Image
The storefront and both apps share one smart search service — typo-tolerant matching over product name, SKU, category, brand and tags, with live suggestions.
- Suggestions & history — as-you-type suggestions; each customer's recent searches are kept and re-shown on the search box.
- Trending searches — most-searched terms of the period, surfaced on the storefront.
- Search Keywords (admin) — see what customers search for, including no-result terms, so you know what to stock.
Search by image (Settings → Image Search)
Customers can tap the camera icon in the search bar and upload a photo to find matching products.
- Enable image search switch, plus a driver choice.
- pHash (default) — perceptual-hash matching against your own product images. Free, no external account, runs entirely on your server.
- API — point it at an external vision endpoint (URL, model and API key fields) for stronger matching. Third-party cost is not included.
- Re-index button — rebuilds image hashes after you bulk-import or change product photos.
- Leave it off and everything else works normally — the camera button simply is not rendered.

Product Stocks & Purchase Orders
Product Stocks (Purchase & Stock → Product Stocks) shows how many units you have. Add stock with a stock entry (product, quantity, cost price); the system reduces it automatically as orders sell. Open a product for its full stock history.
Purchase Orders (Purchase & Stock → Purchase Order) record goods you buy from suppliers. A PO adds stock and creates a payable (what you owe). Choose the supplier, add products with quantity & cost, record any payment made, and Save — stock and supplier dues update automatically.


Adjustment · Damage · Transfer · Returns
- Stock Adjustment — manually correct counts (e.g. after a physical count).
- Damage — write off broken/expired goods so they leave sellable stock.
- Stock Transfer — move stock between warehouses/locations.
- Customer Returns — goods a customer sends back; records the refund and returns items to stock.
- Supplier Returns — goods you send back to a supplier; reduces stock and your supplier due.
Each works the same way: open the screen → Create → pick the product(s)/original order, set quantity & reason → Save.


Warehouses & Suppliers
Warehouses & Racks (Warehouse) — where stock physically lives. Warehouses are buildings/stores; racks are shelves inside them.
Suppliers — the companies you buy from. Each supplier keeps a due/payment ledger linked to purchase orders and supplier returns. Create a supplier with an opening balance, then open it to see purchases, returns and outstanding due.


Inventory Costing (FIFO / Weighted Average)
Every sale needs a cost to produce a true profit figure. Sellino tracks purchase cost in stock layers and picks the cost per sale using the method you choose in Settings → POS.
- FIFO (default) — the oldest purchase cost is consumed first.
- Weighted Average — a running average cost across all remaining stock.
- The chosen cost is snapshotted on the sale line, so a later purchase at a different price never rewrites past profit.
- Feeds COGS, gross profit and the Profit & Loss statement in Accounting, plus stock-valuation reports.
- Multi-vendor The method is per owner — each seller may run a different method from the platform default.
Pick it before you start trading. Changing the method re-values existing stock — the panel warns you before saving.

Orders & Delivery
Order List — every order placed, filterable by status (pending, confirmed, delivered, cancelled). Tabs: All, In-House, Seller.
Order Details & History — open any order for items, customer, payment and delivery address. Move it forward (Pending → Confirmed → Delivered), view Footprints (who changed what), and send a review request.
Create an Order — place phone/counter orders for an existing customer or a guest (no account).
Edit & Delete — change items/quantity/address, or remove (prefer Cancel to keep a record).
Delivery & Tracking — the Deliver popup records quantity, courier & notes; guest orders can require email-code verification.




Delivery Charges, Couriers & ETA
A single delivery engine decides the charge and the estimated delivery time shown on the product page, at checkout and on the order — always in sync. Everything is managed from the Delivery menu in the sidebar (and vendors get the same tools in the Seller panel and Seller App).
Three delivery areas & the charge formula
- Every charge is set per area/case — Inside (same location), Subcity (different location, same root) and Outside (different root location) — each can be switched on or off.
- The area is worked out from the ship-from origin → destination. Origin is the seller's location when the seller ships, otherwise the platform origin.
- Charge is per invoice:
base once + (total units − 1) × extra-per-unit. Example — base 50, extra 10, qty 10 → 50 + 9×10 = 140. - Each area also carries a delivery-time (ETA) range (min–max, in days or hours) so an estimate always shows.


Every Delivery screen (sidebar → Delivery)
- Delivery Charges (Delivery → Delivery Charges) — the highest-priority rule: a per-product/variant special charge per area. Each row is a variant with an optional shipping partner and, per area, an on/off toggle, base charge, per-extra-unit charge and an ETA override (min–max days). A row without a courier is the product's own Standard/Free charge and ships on the normal (merged) invoice; a row with a courier is that product's charge for that courier — picking it splits the item into its own order. A charge of 0 = Free shipping; a blank area = "not applied" and falls back to the next rule. Multi-vendor Sellers manage their own product rows from the Seller panel/App (area-wise only — the courier column is admin-only).
- Shipping Partners (Delivery → Shipping Partners) — the courier companies buyers can pick (name, logo, status, and a Courier API link of None/Manual, Pathao or Steadfast Courier). Each partner carries its own per-area on/off toggle, delivery charge, per-extra-unit charge and ETA (with a Days/Hours unit). Toggling an area off hides that partner for the area at checkout (a product's own charge row still overrides the toggle).
- Courier Settings (Delivery → Courier Settings) — the API credentials for the integrated couriers, one card each with a Configured / Not Configured badge (Pathao: client ID/secret, username/password, webhook secret, live/sandbox mode; Steadfast: API key/secret, webhook token) so parcels can be booked automatically. A partner left Manual (no keys) still works — its charge applies, only auto-booking is skipped. Couriers are enum-driven, so more can be added without touching the screens.
- Delivery Settings (Delivery → Delivery Settings) — the platform defaults and final fallback: platform origin location, a default shipping partner, an optional "book parcel when order reaches status" automation, and the per-area default charges, per-extra-unit charges + ETA (min/max and unit).
- Seller Delivery Settings Multi-vendor (Delivery → Seller Delivery Settings) — per-seller config: a Ship-by-seller toggle, the seller's origin location, and per-area default charges + ETA (blank inherits the platform defaults). Admins get a per-seller overview + edit page for any seller (plus an admin-only Allowed Shipping Partners allowlist that limits which couriers may be used for that seller's orders); sellers manage their own from the Seller panel/App. When Ship by seller is on, the area is measured from the seller's origin and that seller owns the delivery charge.
- Locations (Delivery → Locations) — the zone hierarchy (district → sub-locations) that powers the whole engine. The root of each location is what decides Inside / Subcity / Outside when origin and destination are compared.
Which charge applies — precedence
| # | Rule | When it wins |
|---|---|---|
| 1 | Product-wise Delivery-Charge row (variant + area match) | Always beats everything else — the special charge you set on the product. |
| 2 | Chosen courier's area charge | Customer picked a courier → that partner's charge for the area, else the admin default. |
| 3 | Seller default Multi-vendor | No courier chosen and the product ships by seller → the seller's per-area settings. |
| 4 | Platform / admin default | Nothing above matched → the global Delivery Settings values. |
What the customer sees
- On the product page — the resolved delivery charge + ETA for the buyer's area, with a picker when there is a choice: Free, Standard, or a specific courier. The chosen courier is remembered for checkout.
- At checkout — a per-item picker plus a single common-courier block for all the "plain" (no per-product picker) items; only couriers that serve every required zone (and, in multi-vendor, are allowed by every seller) are offered. Picking a courier for an item splits it into its own order; switching back to Standard/Free merges it. A combined ETA and a "Free shipping" label show live.
Fulfilment — Confirm Shipment, booking & tracking
- Confirm Shipment popup — choose the delivery method (any active partner, badged API or Manual, or a plain Manual delivery option). The delivery charge auto-fills for the courier & area and stays editable; a lowered charge refunds the overpayment to the customer wallet. The modal can auto-open when the order reaches the configured status.
- Book parcel via API — flip "Book parcel now" and set COD amount (defaults to the order's due), weight (kg), quantity and a note; Sellino books with Pathao/Steadfast and stores the tracking ID + URL. Non-API partners are recorded as manual. Multi-vendor booking respects the seller's Allowed Shipping Partners allowlist.
- Change / Cancel — swap the partner before booking, or cancel a booked parcel (Pathao via API; Steadfast is cancelled in their portal).
- Live status — the shipment moves through pending → booked → picked → in transit → out for delivery → delivered (plus cancelled / returned / failed), updated automatically from the courier via webhook and shown as a badge with the tracking link on the order.
Good to know: Free shipping is any resolved charge of 0 (a product/area set to 0, or a free-shipping coupon) — there is no separate module. COD collection amount is passed straight to the courier. The delivery charge is a flat per-invoice amount — order-line tax is handled separately and is not added on top of shipping.
Accounting-aware: delivery income is recognised at delivery — until the order is delivered, customer payments sit in an Advance account, so your books never over-state income.
Delivery Men (Riders)
Besides courier companies, you can deliver with your own riders. A delivery man gets his own rider panel login, updates each delivery step by step, and his commission and salary flow into accounting and payroll automatically. Riders handle manual shipments — parcels booked with a courier API are carried by the courier's own staff, so those don't need a rider.
Create riders (Delivery → Delivery men)
- Each rider gets a login account (name, unique email & phone, password) plus profile details — vehicle type & number, NID, license, photo and an active/inactive switch. A rider code like
DM-0001is generated automatically. - Commission per delivered parcel — None, Fixed (flat amount) or Percentage (% of the order's delivery charge).
- Monthly salary (optional) — a salaried rider is automatically linked to an HR employee record, so the normal Payroll run pays him. You can also link an existing employee.
- Multi-vendor Admin riders belong to the platform; a seller can manage their own riders from the Seller panel when you enable Seller Delivery Men in Settings → Preference.
Assign a rider to an order
- Open the order → Customer & Delivery card → Delivery man section: pick a rider and click Assign (or Unassign to release him). The section appears for manual deliveries only.
- The dropdown shows only eligible riders — the seller's own riders when the order ships by that seller, otherwise platform riders. Delivered/cancelled orders can't be assigned.
The rider panel (yourdomain.com/delivery/login)
- Dashboard — active, out-for-delivery, delivered-today, total-delivered and failed counters.
- My Deliveries — assigned parcels with search & status filters. Each delivery shows the items, address (tap-to-call phone) and the COD amount to collect.
- Status flow — the rider moves a parcel through Pending → Picked → Out for delivery → Delivered (or Failed, which requires a note; a failed parcel can go out for delivery again). Delivered/Failed steps record a proof entry — note plus optional photo.
- My Earnings — his delivery history with the commission earned per parcel.
Delivery OTP (optional — Settings → Preference)
- Two admin-only switches: one for platform/in-house deliveries, one for seller-shipped parcels. Sellers cannot turn these on or off.
- When on, a 4-digit code is sent to the customer (SMS first, email as fallback) and the rider must enter it to mark the parcel Delivered — proof the right person received it.
- The code is stored hashed, is valid for 1 day, and the rider can trigger a resend.
Accounting is automatic: when the rider marks a parcel Delivered, his commission is written as that shipment's courier charge (never overwriting a charge you entered by hand) and posted as delivery expense — owned by the platform, or by the seller when the seller ships his own order. Failed attempts earn nothing.
Shipment Confirmation (Before Dispatch)
Every parcel must be confirmed before its order can move to To Delivery or Delivered. Confirming is where you record the courier charge — what you pay to move the parcel — and that number is the only input to the delivery-expense journal. An order dispatched without it would book its delivery cost as zero forever and quietly inflate the profit on that order, so the step is now enforced instead of optional.
- How you confirm — on the order page use Confirm Shipment: pick the delivery method (your own rider or a courier), check the delivery charge the customer pays and enter the courier charge you pay. Booking through a courier API confirms the parcel automatically and fills the charge from the booking.
- The status dropdown respects it — until the parcel is confirmed, To Delivery and Delivered are greyed out with a lock and a short explanation, in the admin panel, the seller panel Multi-vendor and the Seller App. There is no way around it — POS sales (no parcel) and installs with the delivery module off are skipped.
- The charge stays correctable — if the courier bills a different amount later, edit it from the same order page after dispatch and even after delivery (only a cancelled order is closed to it). The old delivery-expense journal is deleted and re-posted, so the accounts always match the shipment.
- Multi-vendor A seller shipping his own order sees the same courier bar and confirms it himself — from the panel or the Seller App, with identical rules.
Daily habit: confirm the shipment when you hand the parcel over, not at the end of the day — the charge is freshest then, and the order cannot be dispatched until you do.
Order Edit & Cancel (Pending Orders)
While an order is still Pending, it can be changed or cancelled — by your staff on the admin order page, by the seller Multi-vendor, and by the customer himself on the website and Customer App. All surfaces share the same rules, and a built-in "How it works" panel explains them right on the page. Once the order moves past Pending, editing locks automatically.
What can be changed
- Add a product — a search shows only products that are allowed into this order: same seller, in stock, and not a courier-specific (special-delivery) product. A product with its own courier ships alone in its own order — it can't join a mixed order, and nothing can join its order.
- Change quantity / remove an item — totals, delivery charge and coupon amounts recalculate instantly.
- Cancel order — one click with an optional note, keeping a full record (better than deleting).
What happens to the money
| Change | Effect |
|---|---|
| Total goes up | The extra becomes amount due, collected on delivery (COD) — nothing is charged immediately. |
| Total goes down | The excess payment is held as an advance and refunded to the customer's wallet at delivery. |
| Order cancelled | Money already paid is refunded to the wallet right away; wallet or affiliate balance that was applied is restored. |
Why wallet? Wallet refunds are instant store credit — the customer can spend them immediately or withdraw per your policy, and every movement is journaled in Accounting automatically.
Returns, Replacements & Refunds
After delivery, customers can raise a return or a replacement against an order item — from the website, the Customer App, or their account. You process each request through a clear status flow with full accounting and stock effects.
- Return Requests (Return → Return Requests) — approve/reject, arrange pickup, inspect the returned item (record fault & who pays return shipping), then finalise the refund.
- Replacements (Return → Replacements) — swap the item for the same (or a different) product instead of refunding money.
- Refund methods — choose how the money goes back: Wallet (instant store credit), Manual/Cash, or Bank transfer (with reference & notes recorded).
- Stock & accounting — resalable returns go back into inventory; items marked Lost/Damaged post an inventory-loss entry instead. Every refund is journaled automatically.
Tip: Deep-link from any order — the order page has Return / Replacement buttons that pre-select the right order for the customer.
POS — Counters, Registers & Cash
POS (Point of Sale) lets staff ring up counter sales fast.
- Counters (POS Management → Counters) — create one per till/location.
- Cash Registers — open a register with a starting balance at shift start, close it at shift end to reconcile cash.
- Petty Expenses — small cash spending from the drawer (tea, transport), auto-recorded as an expense.
- Cash Pickup — when a manager removes cash from a register to the safe/bank, record it so the drawer stays accurate.
To sell: open the POS screen, pick the counter, open the cash register, scan/search products and take payment (Cash, Bank, Mobile or Mixed).
POS Settings
- Inventory Costing Method — choose FIFO (oldest purchase cost first) or Weighted Average; this drives cost-of-goods and profit for both POS and online sales. Changing it re-values existing stock, so the page asks you to confirm.
- Default Customer & Warehouse — the walk-in customer and warehouse pre-selected on the POS screen.
- Max discount, receipt logo & footer — cap the discount a cashier can give and brand the printed receipt.
Walk-in customers Multi-vendor
- Every seller automatically gets his own "Walk-in — Shop name" customer, so counter sales of different sellers never mix.
- POS customer search is seller-scoped — a seller only sees his own customers; admin/in-house POS sees the store's own customer pool.
- The walk-in customer can earn but cannot redeem reward points — points belong to real, identified customers.


Customers & Sellers
Customers — everyone with a customer account. Add, edit and view their orders.
Customer Suggestions (sidebar → Customer Suggestions) — review ideas and feedback customers submit from the website/app, update each one's status, or remove it. Customers can also leave product feedback & reviews that show on product pages.
Sellers (Vendors) Multi-vendor only — vendors who list their own products and fulfil their own orders. Add, view their shop & payouts, edit, approve or suspend.


Seller Commission & Payouts
Multi-vendor only The cut your platform keeps from each seller's sale.
- Global Commission — one default rate for all sellers.
- Category-Based — different rates per product category.
- Seller-Based — a custom rate for a specific seller.
- Commission History / Report — earnings over time.
- Payout Requests (Seller → Payout Request) — when a seller withdraws earnings, approve and record the payment, or reject with a reason.


Seller Product & Taxonomy Approval
Multi-vendor Keep quality control over what your vendors publish. Turn approval on in Settings → Preference Settings, then anything a seller creates waits for your review before it goes live.
- Require admin approval for seller products — new/edited seller products stay hidden until you approve them.
- Taxonomy approval — separate toggles for seller-requested Brands, Categories, Attributes and Attribute values; each stays pending & unusable until approved.
- Approve / Reject — review pending items and either approve or reject with a reason. The rejection reason is shown right in the Brand, Category, Attribute and Attribute-value lists so the seller knows what to fix.
- Leave the toggles off to let trusted sellers publish instantly.
Coupons, Campaigns & Membership
- Coupons (Promo → Coupons) — discount codes at checkout (fixed or %, with usage limits and dates).
- Flash Sales (Promo → Flash Sales) — time-limited price drops with a countdown.
- Campaigns (Promo → Campaign) — themed groups of products & offers (e.g. Eid Sale) with a banner and date range.
- Membership (Membership Settings / Members) — in-store membership points used at the POS: set the earn rate, the redeem value, the minimum redeemable points and the auto-enrol purchase amount; see enrolled members. Multi-vendor Membership is per seller — each seller keeps his own rates and his own member list, and admin keeps a separate one for admin's POS. Points earned at one seller can never be spent at another, so no money moves between vendors.
Tip: Always set an end date so a promo doesn't run forever by accident.


Reward Points, Affiliates & Wallet
- Reward Points — customers earn points on purchases and redeem them for discounts; configure earning rules per product.
- Affiliates — partners earn a commission for referred sales via their link/code.
- Customer Wallet — a prepaid balance customers can top up, pay with, and that receives refunds; every movement is recorded in the wallet ledger and mapped to accounting journals.
Two programs — which runs where
These three are the platform program and run online only — storefront and Customer App. The membership points above are the in-store program and run in POS only. They never exchange value, which is exactly why a multi-vendor store needs no settlement between sellers.
| Action | POS | Storefront & App |
|---|---|---|
| Redeem membership points | Yes (that seller's own) | — |
| Pay with wallet | — | Yes |
| Convert reward points → wallet | — | Yes |
| Affiliate join / payout | — | Yes |



Message Center — One Inbox for Every Channel
All customer conversations land in one unified inbox — no matter where the customer writes from: the website chat widget (works for guests, no login needed), WhatsApp, Facebook Messenger, or the built-in customer↔seller chat. Admin opens it from sidebar → Message Center; each seller gets his own scoped Seller Inbox Multi-vendor, and customers have their own messages page on the website and app.
- Two-pane inbox — conversation list on the left (each tagged with its channel and the guest/contact name), thread + composer on the right, with image attachments.
- Website chat widget — a floating "Chat with us" bubble on the storefront. Guests can write without an account; replies you send from the Message Center appear right in their widget.
- WhatsApp & Facebook Messenger — connect once in Settings → Social Integrations: paste your Meta Page ID / Phone Number ID, a Verify Token and the Access Token, then give Meta the webhook URLs shown on the page (
/webhooks/facebook,/webhooks/whatsapp). A Test button confirms the credentials; each channel has its own on/off toggle. - Replies go back out on the same channel — answer a WhatsApp message from the inbox and the customer gets it on WhatsApp.
Auto-Reply — Rules (Free) + AI (Claude / OpenAI-compatible)
Incoming messages can be answered automatically in two layers. Layer 1 is a free rule engine; Layer 2 is an optional AI assistant. A rule answers first when it matches — AI only runs when no rule fires, so simple questions never cost anything. And the moment a human replies in a conversation, auto-reply mutes itself there and lets your staff take over.
Layer 1 — Auto-reply Rules (Settings → Auto-reply Rules)
- Rule types: Greeting, Keyword, Order status (customer sends an order code → gets its live status from the database), Office hours and Fallback.
- Each rule has a trigger, a response, a priority, an on/off switch, and an optional channel scope (widget / WhatsApp / Facebook / internal — blank means all). Multi-vendor Sellers manage their own rules; platform rules are admin-only.
Layer 2 — AI Auto-reply (Settings → AI Auto-reply)
- Master Enable AI auto-reply switch, an AI provider choice, and a Test AI button.
- Provider: Claude — your Anthropic API key (stored encrypted); choose which Claude models may answer (Haiku / Sonnet / Opus, each toggle-able) — the cheapest enabled model is used.
- Provider: OpenAI-compatible — works with OpenAI, Gemini, Groq, DeepSeek or any endpoint speaking the OpenAI API. Fields: base URL, model, API key, plus input/output price per million tokens so cost tracking stays accurate.
- Per-channel AI toggles, office hours, and a monthly budget cap in USD — reaching the cap pauses AI automatically.
- An AI Usage page shows this month's replies, tokens and cost per model against the budget.
Costs: the AI layer uses your own Anthropic API account (pay-as-you-go, not included); WhatsApp Cloud API and Facebook Messenger are Meta services with their own terms. Everything works with all of these switched off — you simply answer manually from the Message Center.
Accounting
Sellino includes a real double-entry accounting system. Sales, purchases, expenses, wallet and payouts post journal entries automatically against your Chart of Accounts (COA).
- Accounts & Banks — set up your COA, cash-in-hand, bank and mobile-money accounts.
- Expenses, Transfers & Owner Money — record expenses, move money between accounts, and owner draw/investment.
- Journals, Transactions & Reconciliation — view every journal entry, the transaction ledger, and reconcile a bank/cash account against a statement.
- Financial statements — Trial Balance, Income Statement (Profit & Loss) and Balance Sheet, built straight from the general ledger for any date range. Multi-vendor Each seller sees their own set; admin sees the platform's.
- Cost of goods sold — posted from the inventory costing layer, so gross profit is real cost, not an estimate.
- Stock adjustments post journals — an IN adjustment books an inventory gain, an OUT adjustment books a loss, valued at cost.
- Discount & delivery ownership — a coupon is recorded against whoever funds it (platform or seller), and courier/rider delivery cost is expensed to the party that actually ships, so seller settlement stays correct.
Reference: See docs/wiki/wallet-accounting.md in the source for the wallet ledger & journal mapping, and docs/wiki/supplier-return.md for return journals.


HR & Payroll
Manage your staff from the same panel (HumanResource module).
- Employees & Structure — staff records, departments and designations.
- Attendance & Leave — daily attendance and leave requests/approvals.
- Payroll — monthly payroll generation, posted to accounting automatically. Salaried delivery men are paid through the same run via their linked employee record.
- Employee Loans — create a loan (status Pending, terms still editable), then Approve & Disburse from a cash/bank account to make it Active. Repayment happens automatically as a monthly installment inside payroll, or manually as an off-payroll cash repayment; when fully repaid it becomes Paid. Every step posts its journal to Accounting (employee-loan receivable account).
- Salary Advances — a one-shot advance disbursed from cash/bank and recovered in full from the salary of the month you choose; the payroll run deducts it and marks it Deducted. Journaled the same way on its own receivable account.
Good to know: only disbursed (Active) loans and advances are picked up by payroll — a pending request never touches anyone's salary. Cancelling an active, un-recovered loan/advance reverses its journal cleanly.



Reports
Decision-ready reports across the business, most exportable.
- Sales Reports — sales summary, by product, by category, by customer, profit and more.
- Inventory Reports — stock value, low-stock, movement, expiry and damage.
- Accounting & Cash Reports — trial balance, profit & loss, balance sheet, cash flow, day book and account ledgers.



Storefront (Customer Website)
The storefront is the customer-facing online shop that runs from the same Laravel backend. It is fully responsive, multi-language and theme-driven — everything you set in Website & Content renders here. The same data also powers the Customer App through the API.
Sellino ships with several ready-made homepage demos for different niches — grocery, electronics, fashion, beauty and jewellery — so you can launch a matching look in minutes.
Homepage demos







Browsing & Product Pages
Customers browse by category, brand or seller store, filter and search the catalog, open rich product pages with variations, reviews and Q&A, and grab time-limited deals & flash sales.



Cart & Checkout
A streamlined cart and checkout with multiple addresses, shipping selection and several payment options (online gateway, wallet or Cash on Delivery), ending with an order confirmation.


Customer Account
Each customer gets a full dashboard — profile, order history & tracking, saved addresses, wishlist, recently viewed items and in-app messages with sellers.
- Multi-vendor Followed stores — a Follow button on every seller store page, and a Followed Stores screen in the account area listing them with a one-tap unfollow (with a confirmation). The same list is in the Customer App. Each seller's follower count shows on his profile and in the admin seller list.
- App download QR — the account sidebar carries a QR card that points at your mobile app; the image, title and store links come from the App Download section in Website & Content, so it is edited in one place.


Wallet, Reward Points & Affiliate
Built-in loyalty & growth tools: a rechargeable customer wallet, transaction history, earnable reward points, and a complete affiliate program with referral earnings, conversions and withdrawals.


Content & Info Pages
Standard storefront pages — About, Contact, Blog and the legal pages (Privacy Policy, Terms & Conditions, Return & Refund) — all editable from Website & Content. The legal pages and any page you create yourself live in Static Pages; their layout comes from the Page Builder.

Website & Content
Shape the storefront without code — content also feeds the apps/API.
- Appearance & Builder — theme colors, fonts and homepage layout.
- Sliders & Notices — homepage sliders and announcement bars.
- Widgets & Sections — modular homepage blocks (hero, featured, banners).
- Blogs, FAQ & Links — articles, site FAQs and footer links.
- Reviews & Testimonials — moderate product reviews and show testimonials.
- Static Pages — Privacy, Terms, Refund and any page you add yourself; see Static Pages below.
- Vacation Mode — pause ordering for a holiday without closing the site; see Vacation Mode.
Ready-made homepage sections
Sections are picked from a library and dropped onto a page — each one has its own settings form. Beyond the classics (hero slider, banners, best sellers, blog, newsletter) the library includes:
- Deals — a deal strip with a live countdown, plus a deals-by-category block on mobile.
- Featured Categories and Shop by Category — category tiles driven by the category icon image.
- More to Love — an endless product feed for the bottom of the homepage.
- App Download — app banner with QR code and store links; the same content feeds the account-page QR card.
- Facebook Page — embedded page plugin.
- Auth Notice — the promo panel shown beside the login / registration forms.
- Mega Menu — the header's multi-column category menu, built from your category tree and its icons.


Media Library & Picker
All uploaded images and videos live in one Media Library. Every image field in the panel — products, sliders, widgets, blogs, brands, categories — opens the same media picker, so you upload once and reuse everywhere.
- Browse & search — grid view with type filter and search over file name, title and alt text.
- Upload — single or multiple files, drag-and-drop. An identical file (same checksum) reuses the existing entry instead of storing a second copy.
- Edit details — rename, set title and alt text (good for SEO and accessibility).
- Usage — every file shows a used in N place(s) count, and you can list exactly where it is attached.
- Safe delete — a file still in use cannot be deleted; remove it from those places first.
- Automatic sizes — each upload is resized into named presets (thumbnail / medium / large) so the storefront serves the right size.
- Multi-vendor Sellers see their own library only; admin sees all.
Videos have their own size cap — set it in settings (media_video_max_mb, default 100 MB).
Static Pages (Website → Pages)
Write your own pages — Shipping Info, Careers, Store Locations, anything — and they go live at yourdomain.com/your-slug. One edit here reaches the blade storefront, the Next.js storefront and both mobile apps, because all three read the same page through the API.
- Create a page — Website → Pages → Create. Fill in Title, Slug (the URL), the rich-text Content, an optional banner image, and Meta title / description for search engines.
- Status — unpublished pages return 404 on the storefront, so you can write in peace and publish when ready.
- Footer link — tick Show in footer and set a position to order the footer list.
- System pages — Privacy Policy, Terms & Conditions and Return & Refund Policy ship as pages you can freely rewrite, but their slug is locked and they cannot be deleted — the footer, checkout and both apps link to those exact URLs.
- Permissions —
page_read / page_create / page_update / page_deletein Users & Roles, so a content editor can manage pages without touching anything else. - Safe URLs — a page can never hijack an existing route. A slug is only served after every other URL has been checked, so naming a page cart or login simply does nothing.
Upgrading? Privacy / Terms / Refund text used to be edited under Global → Website Section. It moved into Pages automatically — your existing wording is intact, just edit it in the new place.
Page Builder — Inner Pages (Website → Page Builder)
The builder is not only for the homepage. Pick a page, then stack sections on it from the library and fill each section's own form — no code, no theme files.
Pages you can build
| Group | Pages |
|---|---|
| Shop | Shop / product list, Categories, Brands, Deals, Product details, Wishlist |
| Buying | Cart, Checkout |
| Content | About, Contact, Blog list, Blog details, and the legal pages (Privacy, Terms, Return & Refund) |
| Accounts | Login, Registration, Forgot / Reset password |
| Multi-vendor Seller | Seller stores list, Seller login, Seller signup, Seller forgot / reset password |
- Section settings — every section carries its own fields (titles, images, buttons, links, show/hide switches) with sensible defaults, so a page looks finished the moment you add it.
- Layout style per page — most pages offer more than one design (e.g. About Style One); switch style without losing your text.
- Spacing — each section takes separate top/bottom padding for mobile, tablet and desktop.
- Header & footer — chosen from the same library, including the mega menu header and the footer variants.

Vacation Mode (Global → Website Section → Vacation Mode)
Going on holiday, or pausing orders during a stock count? Vacation mode stops ordering while the shop stays browsable — customers still see your catalogue and prices, they just cannot buy until you are back.
- Switch — On / Off.
- Start time & End time — schedule the pause in advance. Leave a side empty for open-ended: on with no dates means closed until you switch it off.
- Title & Message — what the customer reads. Leave them blank to use the built-in wording (translated with your language packs).
What customers see
- A notice banner on the storefront, the product page and the cart.
- Add to cart, checkout and order placement are blocked — on the blade storefront, the Next.js storefront and the Customer App alike, with your message shown instead of a raw error.
- Browsing, search, wishlist and account pages keep working.
Vacation mode is store-wide, not per seller. Turning it on pauses ordering for every vendor.
Web Theme, App Theme & Product Card Styles
Look-and-feel is split into two independent theme pages, so the website and the mobile apps can be styled separately.
- Settings → Web Theme — storefront colors, corner radius for cards / inputs / buttons, and the footer layout variant.
- Settings → App Theme — the same kind of controls for the Customer & Seller apps, delivered through the API (no app rebuild needed).
- Product card styles — pick how product cards look (multiple ready-made styles) from Appearance, globally or per homepage widget.
- Section padding — every homepage section takes separate top/bottom spacing for mobile, tablet and desktop.
- Homepage demos — apply a ready-made demo layout to your live homepage in one click, then edit it.


Administration
- Users & Roles — role-based access control. Create roles with Read/Create/Update/Delete permissions per module, then assign staff to roles.
- Languages — add languages (with LTR/RTL), set the default, and translate phrases per module. Four packs ship ready: English, Bengali, Arabic and Hebrew (the last two RTL). The same translations feed the admin panel, the storefront and both mobile apps through the API — translate once, everywhere updates. English is the fallback and cannot be deleted.
- Activity & Login Logs — audit trail of admin actions and login history.



Settings
- General — store name, contact, currency, timezone, date/time format, pagination and branding (logo/favicon).
- Appearance & Colors — primary/secondary colors, fonts and button shapes.
- Mail — standard SMTP, or the Gmail API transport (client ID, client secret, refresh token, from-name/address) when your host blocks SMTP ports 25/465/587 — common on cloud VPS providers. A Test mail button confirms either one.
- SMS / Push — SMS gateway, and push notifications used by the mobile apps.
- Media & Themes — see Media Library and Web / App Theme.
- Security — reCAPTCHA & API key; OTP channels & social login; backups.
- Payment Gateways — enable and key your gateways: SSLCommerz, bKash, Nagad, EPS for local payments and Stripe / PayPal for international cards — see Stripe, PayPal & Currency Rates. Use live keys over HTTPS.
- SEO, Menus, Login — meta/SEO defaults, navigation menus, and the admin login slug.
- Storage — keep uploads on local disk or point them at an S3-compatible bucket (see below).
- Preference Settings — feature switches, including seller product & taxonomy approval.
Payment keys: test keys only process test transactions. Switch to live keys on an HTTPS domain before going live.
Payment gateways are third-party services. Stripe, PayPal, SSLCommerz, bKash, Nagad and EPS are operated by their own companies and are not included in this item. You must open your own merchant account with each gateway you want to use, accept that provider's terms, complete their verification, and pay their setup, subscription and per-transaction fees directly to them. Sellino only stores the keys you enter and calls the gateway's API on your behalf — see Third-party services & costs.


Stripe, PayPal & Currency Rates (Settings → Payment Gateway)
Third-party services notice. Stripe and PayPal (like SSLCommerz, bKash, Nagad and EPS) are third-party payment services, not part of this item. As the buyer you are responsible for registering and verifying your own account with each provider, and for any transaction, payout or subscription fees they charge. Sellino only stores the API keys you enter and connects to the provider on your behalf.
Stripe and PayPal cannot charge in every local currency — a BDT store, for example, must charge the card in USD. Sellino handles that for you: your shop keeps one base currency (the currency in Settings → General), the international gateway charges its own currency, and your accounting never leaves the base currency — orders, payments and journals stay in the money you actually keep books in.
Stripe
- Paste the Publishable key and Secret key, choose the charge currency, and switch the gateway on.
- Test vs live follows your keys — an
sk_test_…key runs test mode,sk_live_…runs live. There is no separate toggle to forget. - Webhook — the card shows the exact webhook URL to paste into your Stripe dashboard, plus a signing secret field. This is what confirms a payment when the customer pays and then closes the browser before coming back.
- Customers are sent to Stripe's own hosted checkout page — no card data ever touches your server.
PayPal
- Client ID + Client secret, a charge currency, and a Live mode switch (off = sandbox).
- The payment is captured the moment the customer returns from PayPal, so no webhook setup is needed.
Currency exchange rates
Same page, Currency Exchange Rates card. A rate is read as how many units of that currency equal 1 unit of your base currency — with BDT as base, USD sits around 0.0091.
- Type rates by hand per currency, or hit Fetch live rates for a one-click update from a public rates service.
- Auto-update — turn the daily switch on and rates refresh every night at 01:00. Needs the scheduler cron running.
- Each currency shows when its rate was last updated.
What the customer and you see
- At checkout an international method shows an approximate converted amount ("≈ $12.40"), live-updating as the cart total changes — on the storefront, Next.js and both apps.
- The rate used is frozen on the payment at the moment payment starts, together with the charged amount and currency, and is shown on the admin payment record. A rate change tomorrow can never rewrite yesterday's order.
Missing rate = blocked payment. If a currency has no exchange rate, starting an international payment fails with a clear message instead of charging a wrong amount. Set the rate (or fetch live rates) before enabling Stripe/PayPal.
Gateway secrets (Stripe secret key, webhook secret, PayPal client secret) are stored encrypted in the database, like your mail credentials.
Stripe, PayPal and SSLCommerz are independent third-party services and are not included in the item price. Every key on this page comes from an account you open and own: a Stripe account, a PayPal Business account, an SSLCommerz merchant account. Each provider runs its own onboarding/KYC, sets its own country and currency availability, and charges its own per-transaction and payout fees, which you pay directly to them. Sellino does not process, hold or route money and takes no cut — it hands the customer to the gateway's own checkout and records the result.
Nagad is domestic only — it charges BDT by design and is not part of the currency conversion flow.

Security (2FA, reCAPTCHA, API Key)
- Two-step verification — when enabled, admin login asks for a one-time code emailed to the user after the password step.
- Google reCAPTCHA (Settings → reCAPTCHA) — on/off switch plus site key and secret key. Protects admin login, customer signup and seller signup from bots. Get free keys from Google reCAPTCHA admin.
- Admin login slug — the admin panel URL is randomized, see Login & Security.
App API Key (Settings → API Security)
A shared key your own clients send as the X-App-Key header on every API request. Requests without it are rejected with 401, so random scripts hitting your API are turned away. The page shows a Protection active / disabled badge, lets you show / copy the key, tells you when it was last generated, and has a built-in How it works panel.
- Empty = off (fail-open) — with no key configured nothing is enforced, so an install that never opens this page keeps working.
- The blade website is exempt — browser requests from your own domain skip the check (a browser cannot hold a secret header); they are covered by session & CORS. Only non-browser callers need the key.
- Source — the key set here wins;
APP_API_KEYin.envis the fallback. A badge tells you which one is active (Managed here / From .env).
Where the key goes
| Client | Where you paste it |
|---|---|
| Customer App | lib/core/env/prod_env.dart (and dev_env.dart for the dev key) → rebuild |
| Seller App | lib/core/env/prod_env.dart (and dev_env.dart for the dev key) → rebuild |
| Next.js storefront | APP_API_KEY in its .env — server-only, never NEXT_PUBLIC_* → redeploy |
Regenerating breaks every installed app. The key is compiled into the Customer and Seller apps at build time — the moment you generate a new one, every app already on a phone gets 401 Unauthorized and stays broken until a new version carrying the new key is published to the stores and the user updates. The Next.js storefront only needs its env var updated and a redeploy. Only regenerate if the key has leaked, or before your first release. The panel makes you tick a confirmation box first.
Scope: this is a casual outer filter, not strong security — a key shipped inside a mobile app can be extracted. Rate limiting is the real protection; the key removes low-effort noise and gives you a rotation kill-switch.
OTP & Social Login
OTP channels (Settings → Preference)
- Email OTP and Mobile OTP have separate on/off switches — run either, both, or neither. Codes are 4 digits.
- Used for customer signup / login verification and for verifying a changed email or phone number.
- Mobile OTP needs an SMS gateway configured in Settings → SMS; email OTP needs working mail.
- One identifier field — login, signup, OTP and password reset all take a single box where the customer types either an email or a phone number. A phone is stored in one canonical international form, so
01811843300,8801811843300and+8801811843300are the same person — no duplicate accounts, and no OTP sent to a number the customer cannot verify. Numbers typed without a country code are completed with your store's country. - Other switches on the same page: Order-placed email, Recently viewed, order-code and member-ID prefixes, Seller delivery men, and seller product approval.
Social login (Settings → Social Login)
- Google and Facebook sign-in, each with its own on/off switch, client ID and client secret.
- Both off → only email/phone login is offered. Accounts created socially merge with an existing account on the same email.
Push Notifications (Firebase)
Sellino sends push notifications to the Customer and Seller apps through Firebase Cloud Messaging (FCM) — for order updates, delivery, returns/refunds, payouts and admin announcements. This is the server half, configured in Settings → Push.
- Create a free Firebase project and download its service-account JSON.
- On the Push page, tick Enable push notifications, upload the JSON (the Project ID auto-fills), and hit Test connection to confirm.
- Devices register automatically when a user signs in to an app, so notifications reach the right person on all their devices.
- Push campaigns — compose a promotional push, target an audience and send it now or schedule it; due campaigns are fanned out by the scheduler.
- Leave push disabled and everything else keeps working — it is fully optional.
Full procedure: the mobile apps also need their own Firebase config files, and iOS needs an APNs Auth Key. Because those steps are shared by the backend and both apps, they are documented once in Common Setup → Push Notifications (Firebase).
Note: Firebase is a Google service. A project is free to create, but any usage beyond its free tier is billed by Google and is not included in this item.
Storage (Local or S3-Compatible)
By default all uploaded media (product images, banners, attachments) is stored on your server's local disk — nothing to configure. When you outgrow that, switch to any S3-compatible bucket (AWS S3, DigitalOcean Spaces, Wasabi, MinIO, etc.) from Settings → Storage.
- Enter your bucket credentials on the Storage page and choose it as the active disk.
- Storage is per-file aware — files already saved locally keep serving from local, while new uploads go to the bucket, so switching over is safe and non-destructive.
- Great for scaling media off the app server and putting files behind a CDN.
Tip: Local disk is perfect to launch with. Move to a bucket only when your media volume or traffic calls for it.
Backups (Database & Files)
Two separate backup pages, both uploading to your own Google Drive: Settings → Database Backup and Settings → File Backup.
- Database Backup — dumps the MySQL database. Fields: enable switch, mysqldump path (leave default unless your host puts it elsewhere), and the Google Drive credentials.
- File Backup — archives the
public/directory (uploaded media). Adds a chunk size (MB) field so large archives upload in resumable parts. - Google Drive credentials — client ID, client secret, refresh token and target folder ID, from your own Google Cloud project. Drive storage cost is yours and not included.
- Run them —
php artisan backup:databaseandphp artisan backup:files. Automate with the scheduler cron entry.
Always take a fresh database and file backup before updating to a new version.
Facebook Pixel
Measure your Facebook/Meta ads with the built-in Facebook Pixel integration — no code needed. Paste your Pixel ID into Settings → SEO Settings → Facebook Pixel ID and tracking starts on the storefront. Leave the field empty and no tracking script is loaded at all.
Events tracked automatically
- PageView — every page visit.
- ViewContent — a product-details view, with the product's info.
- AddToCart — whenever an item goes into the cart.
- InitiateCheckout — the checkout page opens.
- Purchase — the order-complete page, with the order value. The order code is used as the event's dedupe ID, so a page refresh never double-counts a sale.
Tip: verify events with Meta's Events Manager → Test events after saving the ID — you should see PageView fire on your first storefront visit.
Sitemap & robots.txt
Built into Settings → SEO Settings — no plugin needed.
- Generate sitemap — writes
sitemap.xmlcovering static pages, products, categories and blog posts. Re-generate after big catalog changes; a View button shows the current file. - Generate robots.txt — writes the crawler rules file, also viewable from the panel.
- Structured data — product, breadcrumb and organisation JSON-LD is output on storefront pages automatically for rich results.
- Per-page meta title/description and the default SEO image are set on the same page (and per product/blog on their own forms).
Submit https://yourdomain.com/sitemap.xml to Google Search Console once after launch.
Troubleshooting
Most post-install issues come from server configuration, permissions or the .env file. Work through these before contacting support.
1. Blank page or HTTP 500 after install
- Open
storage/logs/laravel.log— it names the exact error. - Confirm
APP_KEYis set; if empty, runphp artisan key:generate. - Make sure the web root points to the
public/folder, not the project root.
2. "Permission denied" / cannot write to storage
chmod -R 775 storage bootstrap/cache; on cPanel set the folder owner to your hosting user.
3. Database connection error
- Verify
DB_HOST(usuallylocalhost),DB_DATABASE,DB_USERNAME,DB_PASSWORD. - Confirm the user is attached to the database with full privileges.
4. Changes in .env not taking effect
- After editing
.env, runphp artisan optimize:clearto reload config and routes.
5. Changes not showing / old data cached
- Clear caches:
php artisan optimize:clear.
6. Payment not working
- Set the gateway to Active and fill all keys under Settings → Payment Gateways. Use live keys over HTTPS.
7. Emails / OTP not sending
- Complete Settings → Mail with valid SMTP host, port, encryption, username and password, then send a test. Many hosts block port 25 — use 465 (SSL) or 587 (TLS).
8. Real-time chat not connecting
- The chat uses Laravel Reverb (websockets). On a VPS run
php artisan reverb:startand make sure the Reverb host/port are reachable. - Check Settings → Realtime (Websocket) — values saved there override
.env, so a stale App Key/Host in the panel keeps the socket from connecting. After any change there, restart the Reverb daemon.
FAQ
Q: What's included in the purchase?
The Laravel web backend (admin, seller panel, storefront), the Flutter Customer App and Seller App source, the database, and this documentation.
Q: What are the server requirements?
PHP 8.3+, Laravel 12.x, MySQL 8.0+, Composer, Node.js & NPM, with the standard PHP extensions enabled.
Q: Is it single or multi-vendor?
It runs as a multi-vendor marketplace — multiple sellers each with their own products, commission and payouts, alongside your own in-house products.
Q: Do the mobile apps need the website?
No. The Customer and Seller apps talk to the API (/api/v10/*), which runs alongside the web backend.
Q: Can I change logo, colors and texts?
Yes — branding, theme, widgets, pages, blogs, FAQ and policies are all managed from the admin panel, no rebuild required.
Q: Does it support multiple languages?
Yes, with LTR/RTL support. Add languages and translate phrases under Administration → Languages.
Q: Which payment gateways are supported?
Local: SSLCommerz, bKash, Nagad, EPS. International cards: Stripe and PayPal, which charge in their own currency and convert from your base currency automatically (see Stripe, PayPal & Currency Rates). All are configured from Settings → Payment Gateway — keys are entered in the admin panel, no code.
Q: How do I update to a new version?
Back up your database and .env, replace the source files (keep .env and storage/), then run php artisan migrate and php artisan optimize:clear.
Q: I still need help — what should I do?
Check Troubleshooting and storage/logs/laravel.log first, then contact us via our profile with the exact error message.
Third-Party Services & Costs
This item is a software product only. Third-party services and their costs are not included in the item price — including web hosting and domain, payment gateway accounts (e.g. SSLCommerz, bKash), SMS gateway, push-notification services (Firebase / FCM), optional cloud storage (S3-compatible buckets), the Anthropic (Claude) API or any OpenAI-compatible AI provider used for AI auto-reply, Google services (reCAPTCHA keys, Google Drive for backups, Google social login), any external vision API used for search-by-image, Meta services (WhatsApp Cloud API, Facebook Messenger, Facebook Pixel), and Apple/Google developer accounts for publishing the mobile apps. You arrange and pay for these separately, and generate your own application key and credentials during setup.
Changelog
Version 1.1.0
- Stripe & PayPal — international card payments with per-gateway charge currency, encrypted secrets and a Stripe webhook for browser-closed payments.
- Multi-currency exchange rates — manual rates, one-click live fetch, nightly auto-update, and the rate frozen on every payment while accounting stays in your base currency.
- Static Pages — admin-authored pages served at
/your-slugwith SEO meta, footer placement and their own permissions; Privacy/Terms/Refund moved here from website sections. - Page Builder for inner pages — build shop, cart, checkout, blog, about, contact, login/registration and seller pages from the section library.
- Vacation mode — pause ordering for a scheduled window with your own notice, while browsing stays open.
- Dashboard styles — four admin panel looks with screenshot thumbnails, remembered per user.
- Shipment confirmation gate — an order cannot be dispatched before its courier charge is recorded, and the charge stays correctable afterwards with the journal re-posted.
- Seller-wise membership — per-seller in-store points and member list in POS, kept separate from the platform wallet, reward points and affiliate program which run online only.
- Followed stores — customers follow seller stores and manage them from the account area and the Customer App.
- One identifier field — email or phone in a single box across login, signup, OTP and password reset, with phone numbers canonicalised so no duplicate accounts are created.
- New storefront sections — deals countdown, featured categories, shop-by-category, more-to-love, app-download QR, Facebook page and auth notice, plus the mega-menu header and category icons.
- Media Library & picker — one reusable library with search, alt text/title, usage tracking, safe delete and automatic size presets.
- Smart search — typo-tolerant search with live suggestions, per-customer history and trending terms.
- Search by image — camera search on the storefront and apps, with a free on-server pHash driver or an external vision API.
- AI auto-reply providers — Claude, or any OpenAI-compatible provider (OpenAI, Gemini, Groq, DeepSeek…) with its own base URL, model and price settings.
- Inventory costing — FIFO or weighted-average stock layers, cost snapshotted per sale, feeding COGS and gross profit.
- Accounting — Trial Balance, Income Statement and Balance Sheet from the general ledger; stock adjustments post gain/loss journals; coupon funding and delivery cost booked to the right owner.
- Security — admin two-step verification, Google reCAPTCHA, and an app API key with one-click regenerate.
- OTP & social login — separate email/mobile OTP switches (4-digit codes), Google and Facebook sign-in.
- Delivery OTP — optional customer code the rider must enter to complete a delivery, with separate platform and seller switches.
- Backups — database and file backup to your own Google Drive, schedulable.
- Web Theme / App Theme pages, product card styles, and per-breakpoint section padding.
- Sitemap & robots.txt generators plus JSON-LD structured data.
- Push campaigns — targeted promotional pushes, sent now or scheduled.
- Gmail API mail transport for hosts that block SMTP ports.
- Languages — English, Bengali, Arabic and Hebrew packs shipped, shared by panel, storefront and both apps.
- Queue worker & scheduler setup documented.
Version 1.0.0
- Initial release of Sellino — Laravel web backend + Customer App + Seller App.
- POS sales with counters, cash registers, multi-payment and petty cash.
- Product, category, brand, attribute, unit, tax and barcode management.
- Purchase orders, multi-warehouse inventory, adjustment, damage, transfer and returns.
- Orders & delivery; single-vendor and multi-vendor with commission and payouts.
- Area/courier-based delivery charges with default ETA and delivery-time settings.
- Delivery men (riders) with their own panel, per-delivery commission, delivery proof and payroll-linked salary.
- Pending-order edit & cancel on admin, seller and customer sides with automatic wallet refunds.
- Customer returns, replacements and refunds (wallet, manual/cash or bank) with automatic stock & accounting effects.
- Optional admin approval for seller products, brands, categories, attributes and attribute values (with rejection reasons).
- Push notifications via Firebase Cloud Messaging for both mobile apps.
- Local or S3-compatible media storage, switchable from the admin panel.
- Unified Message Center — website chat widget (guest-friendly), WhatsApp & Facebook Messenger in one inbox, with rule-based and Claude-AI auto-reply.
- Facebook Pixel tracking (PageView, ViewContent, AddToCart, InitiateCheckout, Purchase) configured from SEO settings.
- Double-entry accounting: chart of accounts, journals, transactions and reconciliation.
- Marketing: coupons, flash sales, campaigns, membership, reward points, affiliates and wallet.
- HR & Payroll with employee loans and salary advances, role-based access control, multi-language (RTL/LTR) and website builder.
- Multi-vendor marketplace with a REST API for the mobile apps.