doku-malaysia-integrationlisted

## What this is DOKU's Global API covers both Indonesia and Malaysia; Malaysia-specific channels (FPX, e-wallets, BNPL) are just enum values on the same endpoints. senangPay — a Bank Negara Malaysia-regulated, PCI DSS-certified payment gateway — became a DOKU company after DOKU's 2022 acquisition; DOKU's own docs are the correct integration surface for a Malaysia-facing product, not a separate SenangPay API. Canonical source: `https://doku-developers.apidog.io`. Verify against it before trusting anything below if DOKU has since revised the API — this skill is a distillation, not a mirror. ## Environments and credentials | Environment | Base URL | |---|---| | Sandbox | `https://api-sandbox.doku.com` | | Production | `https://api.doku.com` | Per environment, per merchant, DOKU issues three credentials: - **Client ID** — identifies the merchant account (e.g. `BRN-001-0000001`). - **Secret Key** — never sent directly; used only to compute the `Signature` header (HMAC-SHA256). Treat like a password. Encrypt at rest. - **API Key** — used as the `Authorization` header via HTTP Basic auth with no password: `Authorization: Basic BASE64(API_KEY:)` (note the trailing colon before encoding). **Never commit these to a repository or write them into a planning doc/PRD/memory file.** Store dev credentials in a local secrets store (this environment: `~/.config/ai-local/secrets.env`, read via `secrets-env`, never `source`d). A PEM public key or other multi-line value doesn't fit that fi