Signing In to the Admin Portal

The admin portal is the web interface used to manage stores, review transactions and monitor the health of the integration. It is protected by two-factor authentication: your email and password, plus a one-time PIN (OTP) delivered to your WhatsApp.

Before you can sign in

You need an account created by a system administrator. Your account contains:

Field	Used for
Email address	Your login username
Password	Stored securely (BCrypt hash) — the first factor
Phone number	Your WhatsApp number — receives the OTP

WhatsApp required The OTP is delivered via WhatsApp (through the Whapi gateway). If your registered phone cannot receive WhatsApp messages, you will not be able to complete sign-in. Contact your administrator to update your phone number.

Sign-in steps

Step 1 — Open the portal

Navigate to https://server.zra.co.zm/pckzra/login. You will see the sign-in form asking for your email and password.

Step 2 — Enter your credentials

Enter your email and password and submit. The system checks:

That the email exists in the users table
That the password matches (BCrypt comparison)

If either check fails, you are returned to the login page with an error. There is no information leak about which factor failed.

Step 3 — Receive the OTP on WhatsApp

On successful credential validation, the system:

Generates a random 6-digit OTP
Saves it against your user record with a 5-minute expiry
Sends it to your registered WhatsApp number
Redirects you to the verification page (/pckzra/verify-otp)

Step 4 — Enter the OTP

Type the 6-digit code into the verification form and submit. The system checks that the OTP matches and has not expired. On success, an HTTP session is created and you are redirected to the dashboard.

If the code doesn't arrive

Wait up to 30 seconds — WhatsApp delivery can lag.
Use the Resend OTP option. This generates a new code and invalidates the previous one.
After 5 minutes the code expires — request a fresh one.
If nothing arrives after several attempts, confirm with your administrator that your registered phone number is correct and that WhatsApp notifications are enabled on the server (whapi.api.enabled=true).

Your session

After OTP verification you hold a server-side session; no further OTP is needed while it lasts.
Closing the browser may keep the session alive until it expires server-side.
Always use Logout (/pckzra/logout) on shared computers — this invalidates the session immediately.

Common sign-in problems

Symptom	Cause	Fix
“Invalid credentials” on login	Wrong email or password	Re-check credentials; ask an administrator to reset the account
No WhatsApp message	Wrong phone number on account, or Whapi disabled	Verify phone number with administrator; check `whapi.api.enabled`
“OTP expired”	More than 5 minutes elapsed	Use Resend OTP and enter the new code promptly
OTP rejected immediately	A newer OTP was already issued (resend invalidates older codes)	Use only the most recent code
Redirected back to login after OTP	Session cookie blocked	Allow cookies for `server.zra.co.zm`; avoid private-mode restrictions

Security notes

Passwords are stored as BCrypt hashes — they cannot be recovered, only reset.
OTPs are single-use, 6 digits, and expire in 5 minutes.
The portal and the POS API use separate security chains: the portal uses sessions, the API uses stateless JWT Bearer tokens. Compromise of one does not imply the other.