Skip to content

What's new

Changes you may notice as a developer or merchant, newest first. Questions: [email protected].

November 2026

  • Developers PHP SDK: when report requests are rate limited (HTTP 429), the legacy SnapNPay report methods (GetPaymentReport, GetPaymentReportAllPages, GetFpxRequestReport, GetFpxRequest, GetTransactionHistory) now throw SnapNPay\ReportRateLimitedException with a "try again in N seconds" message, instead of returning false. Unlike the login SnapNPay\RateLimitedException, it is not a LoginException, so keep the user signed in. Download the updated SDK.
  • Developers PHP SDK: when report requests are rate limited (HTTP 429), Tulus report methods (GetPaymentReport, GetPaymentReportAllPages, GetFpxRequestReport, GetFpxRequest, GetTransactionHistory) now throw Tulus\RateLimitedException with a "try again in N seconds" message, instead of returning false. It is not a LoginException, so keep the user signed in. Download the updated SDK.
  • Developers Links to portal pages now show a title, a short description and the Tulus logo when shared in chat apps and search results.
  • Developers The "Tulus Developers" title in the top bar stays white when you point at it on the SDK Playground, QR code and receipt pages, instead of turning dark blue on the dark bar.
  • Developers PHP SDK: when too many logins are tried, SnapNPay::GetToken now throws SnapNPay\RateLimitedException (a LoginException) with a "try again in N seconds" message, instead of returning false. Download the updated SDK.
  • Developers Reference tables on phones keep field names whole and scroll sideways instead of breaking words letter by letter, and wide code examples can be scrolled with the keyboard. See Callback reference.
  • Developers ADB webhook guide rewritten to match the server: Tulus files each payment under the zakat board itself (the agency field is ignored), a wrong secret answers 400, status must be lower case, and resending an orderno with a different status or amount replaces the payment. Adds the Staging endpoints and how to test. See ADB payment webhook API.
  • Merchants Merchant portal: you can type or paste a date or a date range into Date Range, for example 2026-11-01, 1/11/2026 or 1 Nov 2026 – 10 Nov 2026, then press Enter. The calendar opens from its button.
  • Developers GrabPay webhook: a test payment is now an orderno starting with TEST-. Test payments are hidden from merchant reports and are never settled. See GrabPay webhook API.
  • Developers Unknown portal addresses now show a "Page not found" page with links to the main sections.
  • Merchants Staging and local test copies of the merchant portal show a Staging label next to the logo, so they are not mistaken for Production.
  • Developers Staging moved to staging.tulus.my (payments and API) and reports-staging.tulus.my (merchant portal), with its own data kept apart from Production. Test transactions made on Staging before 9 November are not carried over. The SDK Playground's Staging option now points there.

October 2026

  • Merchants Merchant portal: when the connection drops, reports retry on their own and a status line shows whether you are offline, retrying or still waiting.
  • Developers PHP SDK update: request signatures now encode spaces and ~ the same way as the server, VerifyCallback rejects missing keys and malformed fields, TLS certificates are always verified, and GetPaymentReportAllPages returns false rather than a partial export. Every download is built from the tested source and carries a manifest.json. Download the SDK.
  • Developers Developer portal redesigned: task-first navigation, a contents list on long guides, and phone-friendly tables.
  • Merchants Merchant portal: the remaining custom report views from the old dashboard are available, and the Payment Category filter now also applies to totals and downloads.
  • Developers Transactions from AEON Bank and GrabPay carry fpx_seller_id adb and grab in reports and the report API.
  • Developers GrabPay webhook: at most 100 transactions per call, events more than 90 days old are refused, and data.ic_no is required on every transaction. The partial status was withdrawn. See GrabPay webhook API.
  • Developers Draft GrabPay webhook API published for testing on Staging.

September 2026

  • Merchants Merchant portal: each transaction shows whether its latest callback succeeded, the callback log lists the newest 20 attempts, and a failed callback can be copied as a curl command or resent in bulk ("Resend failed callbacks", for users with callback access).
  • Developers Callbacks for FPX corporate (B2B1) payments approved later by the company's checker are now sent within seconds of approval, including approvals more than 2 days after checkout. Such an order receives a pending callback first, then success or failed. See callback verification.
  • Merchants Merchant portal: the default report list is merged into eight readable columns, a compact layout is optional, and End loads every remaining row.
  • Developers New Laravel integration handoff for teams building on Laravel.
  • Developers Checkout minimum (RM1.00, RM2.00 for FPX corporate) now applies to the amount the payer enters, before charges are added.
  • Developers Receipt emails can be customised per agency through your own endpoint. Try it in the email customisation playground.