# Provider Reference

Operational detail for registered providers. Registry index: [provider-registry.md](../provider-registry.md).

## Payamak

- **Purpose:** SMS OTP for Core and Identity (Identity calls Core OTP client).
- **Config:** `PAYAMAK_*`, `OTP_EXPIRE_SECONDS`, pattern/body id for OTP template.
- **Failure modes:** provider downtime, invalid credentials, rate limits — OTP endpoints must fail safely without leaking existence details beyond product policy.
- **Tests:** `test_otp_auth` and related flows.

## Keycloak

- **Purpose:** Central IdP.
- **Realm:** `superapp`
- **Theme:** `torbatyar` (`infrastructure/keycloak/themes/torbatyar`)
- **Clients:** `superapp-frontend`, `core-service`, `identity-access-service`
- **Public URL:** `KEYCLOAK_PUBLIC_URL` (prod: `https://auth.torbatyar.ir`)

## Let's Encrypt / Certbot

- **Purpose:** TLS for platform and tenant hosts.
- **Automation:** `infrastructure/nginx/provision_ssl.py` via Celery SSH.
- **See:** [ssl.md](../deployment/ssl.md)

## Planned Providers

See registry entries for S3, Payment Gateway, AI models. Fill this file when a provider becomes Active.

## Planned — Payment (Torbat Pay)

- **Purpose:** Tenant commerce payment capture via BYO-PSP or Torbat Pay Merchant facilitator.
- **Architecture:** [ADR-020](../architecture/adr/ADR-020.md), [ADR-021](../architecture/adr/ADR-021.md), [payment-contracts.md](../reference/payment-contracts.md).
- **Iranian PSPs (initial):** ZarinPal, IDPay, NextPay, Pay.ir, Mellat, Parsian, Saman — via Payment adapter registry only.
- **Config:** `PAYMENT_*`, credential vault refs (no plaintext in DB).
- **Failure modes:** PSP timeout, invalid signature, idempotency conflict — fail safe; callback replay protection.
- **Tests:** architecture, tenant isolation, bundle isolation, contract validation (from 14.0+).

## Related Documents

- [Integration Architecture](../architecture/integration-architecture.md)
- [Provider Template](../templates/provider-template.md)