One source of control
Multiple manufacturers connect behind a single SourceRX administration layer. Partners never manage supplier systems, credentials, or catalogs directly.
Viewing — as a SourceRX administrator. Actions here change this partner's real data.
Partner Home
Everything for your product business.
New products available
Build your store, watch orders arrive, or share your unique storefront—all through one controlled partner workspace.
Share My Store
Recent activity
Live orders
Watching for new orders…White-label setup
Build your storefront.
Offer only the SourceRX products approved for your partner account.
Choose what you want to offer.
Select the approved products you want on your storefront.
Choose your store name.
Use your approved DBA for your partner storefront.
—Available
Shown on your storefront and on your terms and privacy pages, so your customers write to you. Leave it empty and SourceRX support is used instead.
Your logo
PNG, JPEG or WebP, up to 256KB. Shown in place of your store name at the top of every page.
or drag one here
Your colour
Used for buttons and highlights. Text on top is set automatically to whatever stays readable.
#1557d5
Review and submit.
SourceRX reviews every storefront before it goes live at your tracked link.
Submission progress
Orders
Orders from your storefront.
Every order a customer has placed on your storefront, who it is going to, and its tracking once the manufacturer despatches it.
Buy stock
Buy in bulk, at the tier your order earns.
Choose quantities and send the request. SourceRX confirms it with the manufacturer, then emails you a link to pay. Nothing is charged until you pay it, and the stock lands in your inventory once the payment clears.
Add quantities to price your order.
Your requests
My inventory
Stock you own.
What you have bought and not yet sold. It is held at the manufacturer under your name and ships from there, so there is nothing for you to store or pack. Sales from your storefront draw it down automatically.
Payouts
What you have earned.
Every sale from your storefront, what it left you, and what has cleared to be withdrawn.
Card fees are taken by the payment processor before the money reaches SourceRX. They are shown here so your figures reconcile — SourceRX does not receive them.
What you made, order by order
On stock you had already bought, the whole sale is paid to you — your profit is that sale less what those units cost you.
Activity
Stock requests
Partners asking to buy in bulk.
Approving a request does not charge anybody. It opens the order for payment and emails the partner a link — they pay on the processor's own page, and their stock appears once it clears.
Already decided
Refunds partners have asked for
Approving decides it. It does not move money — you still issue the refund with your payment provider, and the books update when their confirmation arrives.
Payouts
The book.
What SourceRX has earned, what is owed to partners and manufacturers, and what is still held back.
Processor fees appear as deductions. They are kept by the payment provider out of each charge and never reach this business.
Where each order's money went
Four separate cuts. The processor's is kept by the card company and reaches none of the other three.
Activity
Bundles
Sell more than one thing at a time.
A bundle is your own price for a set of products you already sell. It cannot be priced below what those products cost you — the floor is shown as you build it.
New bundle
Pick at least two products and set one price for the set.
Start from a set
Fills the form below. Nothing is saved until you set a price and press Save, and every field stays editable.
Goes in front of each set name, so they read as yours.
% off sold separately
What is in it
Your bundles
Repeat orders
Offer a discount to customers who want to reorder monthly. They are not charged automatically — the gateway cannot hold a card for that yet — so the checkout promises a reminder at the agreed price, which is a thing you can actually deliver. The agreement and its discount are recorded either way.
Marketing
What your shoppers actually do.
Which products get picked up and put back down. That is interest you already have and are losing, and it is the one thing your orders table cannot show you — an orders table only contains the sales that happened.
By product
Sorted by how many people put it in a basket. A product high on this list with nothing in the last column is priced or described wrongly, not unwanted.
Where they came from
Marketing
Every storefront, and each one on its own.
An average across shops that are not alike is not a reading. The useful question is always which shop is out of line with the others — so this breaks down by partner and narrows to one.
Diagnostics
Everything that didn't do what it was supposed to.
Failed sales and why, deliveries that didn't reach a supplier, errors from the server and from browsers, and controls that were pressed and did nothing. Grouped, so four thousand of one fault reads as one fault.
Run a full check
Sweeps every control on every screen, every readable endpoint, the catalog and the money, and the settings that only matter in production. Reads only — it never presses anything, because on a live system that would place orders and send mail. Each run is kept below.
Why isn't this selling?
A compound is in a supplier's sheet and not on a shelf. Type its name and this walks every gate between the two and names the one that is shut.
Charges that never landed
Payments opened and not settled. Cancel one to make its order permanently unshippable — this moves no money, so void or refund it with the processor separately.
Past reports
Kept so a fault can be dated. "This appeared between Tuesday and Wednesday" is a far shorter hunt than "this is wrong".
Sales that failed
The issuer's own reason, not ours — "declined" tells nobody whether to try again.
Money taken that wasn't accounted for
Settled payments with nothing in the book behind them. Nobody has been credited for these.
Deliveries that didn't reach a supplier
Compounds held twice
Two catalog entries for what looks like one molecule. Supply and prices split between them, and both look correct on every other screen.
Controls that did nothing
Pressed, and then no request, no change on screen and no message. This is the failure that reports itself nowhere else.
Errors
Supplier
Your account.
What you supply, what is waiting to be filled, and what you have earned.
Orders to fill
Orders with your products on them.
Only the lines you supply, and where each parcel goes. Report tracking against these through your API key as you do now.
What you supply
Everything you have told us you can fill.
Taken from your catalog feed. Change it there and it changes here on the next sync.
Earnings
What you have earned.
Your agreed price for every line you have filled. A tenth is held for thirty days against returns, and released on the date shown.
Activity
Get help
Tell us what went wrong.
Anything about a product, a delivery, an order or your shop. Each one gets a reference and a state you can see, so you always know whether it is with us, with the manufacturer, or waiting on you.
Your issues
Partner issues
What partners are stuck on.
Every problem raised, with the whole conversation. Notes you mark private stay on the thread and are never shown to the partner — which is where working something out with a manufacturer belongs.
Clinic commercial view
Clients, orders, and recurring revenue.
Track authorized lead and customer activity without displaying clinical or prescription information.
Client activity
Orders per week, last 8 weeks
Client list
Your pricing
What you charge.
Every product approved for your account, what it costs you, and what you keep after the card processor takes its fee. Leaving a price empty sells at cost — which is a small loss once that fee comes off, so each row names the price that breaks even.
SourceRX admin
Dashboard.
Volume, orders and margin across the network. Revenue is what partners pay SourceRX; profit is what is left after the manufacturer's cost basis.
Stores
StoreStatusOrdersUnitsRevenueProfit
Latest orders
Live orders
Watching for new orders…Product performance
What is selling.
Units, revenue and margin by product, and which stores are ordering each one. Open a product to see the store breakdown.
Download
A snapshot as CSV. Nothing is stored — the file is generated when you ask for it and every download is recorded in the audit trail.
Orders export one row per line item, with unit cost, unit price, margin, carrier, tracking and the address it shipped to.
ProductManufacturerClassUnitsRevenueProfitStores
Approval-only onboarding
Partner applications.
Review businesses before they can access or sell through SourceRX. Approving one creates the partner workspace and issues its login.
Application
NewMulti-manufacturer control
Manufacturer network.
Connect, manage, and assign product sources for the SourceRX partner network.
⌁ Administrator-only controls
Manufacturer assignment, cost basis, and partner-specific markup remain private to SourceRX administrators. Partners see only their approved products and selling experience.
Partner network
Partners.
Every approved business, its storefront state, and the manufacturer behind it. Add one directly, or approve an application.
Connections in and out
Integrations.
Every system SourceRX talks to: the processor that takes the money, the service that sends email, and each manufacturer whose catalog we read and who reports despatches back.
Outbound email
Invitations, approvals and sign-in codes are sent from here. The API key is held in the server environment and is never sent to this page.
Payment processing
A merchant account per partner, so a customer's statement names the shop they bought from. Credentials are encrypted before they are stored and are never sent back to this page.
Checking…
Add a merchant account
A partner's own account is used for their orders, so their customer's bank statement names the shop they bought from. Leave it on Network default for an account any partner may fall back to.
The account reference is for your records only — it is never sent to the processor. Some processors issue a merchant ID you can put here; Eltrovox does not, so any label you will recognise is fine.
Orders only ever route to a processor matching the environment the server is running in. A sandbox account cannot take a real payment even if it is left active.
Both are encrypted with AES-256-GCM before they reach the database, so a database dump alone does not yield them. No page can read either back — only the last four characters are ever returned.
Fill in either or both. Whichever you leave empty is left untouched.
A processor cannot be activated without its credentials, cannot be moved between sandbox and live while active, and cannot be disconnected while active — all refused by the API, not just hidden here.
Manufacturer connections
Two directions per manufacturer. We read their catalog on a schedule; they report despatches and tracking back using a key issued here. Their developers need the integration documentation.
Customer emails
Emails.
What your customers hear from you automatically — order confirmations, shipping updates, and follow-ups. Each one sends from your store\'s name.
Sending is not switched on yet, so nothing will go out even when an automation is on here. Your settings are saved and will start working the moment it is.
Outbound data
API.
A read-only endpoint an outside dashboard can poll for one summary of this business. It exposes totals only — no partner, customer, supplier or product is named in the response.
Endpoint
Paste this into the portfolio hub as the company URL. It answers GET and returns JSON.
Keys
Each key is shown once, when it is made, and is stored here only as a hash. If one is lost, revoke it and make another.
Copy this now. It cannot be shown again.
Paste the raw value. Do not add Bearer in front of it.
What the hub would receive
The live response, read with your session rather than a key, so the figures can be checked before one exists.
Raw JSON
Partner commerce setup
Partner commerce setup.
Assign a manufacturer and control the internal margin for this approved partner.
No partners exist yet. Approve an application under Applications to create one, then configure it here.
Partner access
Who at this business can sign in. A partner with no login cannot reach the platform at all.
Passwords are generated and shown once. This is a prototype — the account list is stored in the page, so these are not real credentials.
Who supplies them
Read from what this partner sells. Each line is filled by whichever supplier can, chosen per order.
Used only where more than one manufacturer can fill a line: this partner's orders go to the preferred one rather than the cheapest. It does not change what they may sell, and a supplier we cannot reach is still passed over — preferring someone who cannot be told about the order would honour the preference by failing to fill it.
Products selected—
Partner statusApproved
Private pricing
Manufacturer price → SourceRX fee → what this partner pays. Owner-only.
Bulk tier
Dropship tier
Manufacturer price••••
SourceRX fee %
This partner pays—
This partner has no tier on the dropship schedule, so they have no cost basis and nothing to select in their storefront.
The manufacturer price is yours alone. It is not sent to this partner, to any other partner, or to an admin — the API returns it to the owner account only. The fee is what SourceRX takes on top; what the partner charges their own customer is theirs to set and is not recorded here.
Storefront setup
DraftSubmission progress
—
Powered by SourceRX
Product catalog
Products.
The catalog held by the API. One row per size, because a size is what carries a price.
Import a price sheet
Adding a few hundred line items through a form is not a workflow anyone follows. Upload your sheet, read the diff, then apply it.
1 · Your sheet
A CSV needs a header row with product and size. Anything with price or tier in its name is read as a price, left to right. category, form and classification are optional, and so are prices.
2 · Read the diff, then write it
Importing the same sheet twice changes nothing the second time — it is matched on product, size and tier, so a spreadsheet can stay the source of truth and be re-imported after every edit.
Lines no supplier declares
Nothing here can be sold — an order for one of these reaches dispatch and finds no manufacturer to send it to. Removing is permanent: the sizes, their prices and any partner's storefront selection go with them. Lines a supplier stops offering are cleared automatically after a sync; these are the ones left over from an import, which no feed will ever mention.
◈ Access rules
Partner accounts see only the products their business type is approved for. Changing availability here immediately changes what every partner of that type can select and order.
Currently configured partner
—Clinic
Products it can offer—
SourceRX settings
Settings.
The onboarding form partners fill in, the service that sends your email, and the automations that fire off platform events.
Application questions
These are the questions on the public apply page, in this order. Changes take effect immediately.
Live preview
Exactly what an applicant sees, rendered from the list above.
◈ Four questions are locked
Business name, business type, primary contact and work email create the partner record and issue its login when an application is approved. They can be relabelled but not removed or disabled.
Answers to every other question are stored with the application and shown to whoever reviews it.
Resend
Transactional and automation email. This reports what the server is actually configured with — it is not set from this page.
⚠ There is no field here for the API key
The key is read from the server environment and never from a request, so no page can submit one and no admin session can read one back. Changing it means setting RESEND_API_KEY in the Railway dashboard and redeploying.
Getting mail flowing
1 · API keySet
RESEND_API_KEY in Railway, then redeploy2 · Sending domainVerify the domain in
EMAIL_FROM with Resend3 · Prove itSend a test from Integrations → Outbound email
Resend issues the DNS records for step 2 — DKIM, SPF, a feedback MX and DMARC — in its own dashboard. They are shown there rather than here so the values are the real ones for your domain.
An unverified domain and an invalid key both fail every send, and they need different fixes. The test send reports whichever one Resend names.
Test the automations
Sends the real message to your own address, you, with sample details in place of anyone's actual credentials. One send per minute.
Email is not configured on the server, so nothing will send even when an automation is switched on. Set
RESEND_API_KEY and redeploy — see Email delivery.
Automations
Every change here is confirmed before it applies.
What each shop sends
Customer emails belong to the shop that sends them. This is what they have chosen.
Send the documentation
Every tab is its own link, so you can send someone the one section they need rather than the whole document.
These pages are public and contain no credentials — a key is issued separately and is never in the document. Sections marked Specified describe agreed shapes that are not built yet, and say so on the page.
Add someone
Admins run the network. Employees do day-to-day work and cannot reach settings, payments or this page.
✓ Account created
Give this password. It is shown once and is not recoverable — if it is lost, use Reset below to issue a new one.
Who has access
The owner is set by OWNER_EMAIL and cannot be changed here. You cannot change or remove your own access — that is what stops an organisation locking itself out.
Help
How this works.
What happens between placing an order and a parcel arriving, and who to ask when something is wrong.
The short version
1You build a storefront from the products SourceRX has made available to you, and submit it for review.
2You add your clients with a shipping address. That address is where the parcel goes.
3You place an order and choose which client it ships to.
4The manufacturer ships it direct to your client. You never handle stock.
5Your client is emailed the tracking automatically — under your name, your logo and your colour. Replies come to you, not to us. That email carries no pricing.
Tracking appears against the order in your order history as soon as the manufacturer reports it.
Getting help
Email [email protected] and a person will answer. Include the order reference if it is about an order — it is the fastest way to get a real answer rather than a request for more detail.
Your own customers should contact you, not us. They bought from your store and have never heard of SourceRX — order confirmations and tracking emails already reply to your address, so this happens by itself.
Pricing
The prices you see are what you pay SourceRX, at the tier set for you. What you charge your own customers is entirely yours to decide — set it wherever you like above your cost. We do not record it and nobody else sees it.
Privacy
You cannot see other partners, and no other partner can see you, your clients or your orders. The manufacturer is given the shipping address and the products, and is not told what anything cost.
Your team
Invite colleagues from Settings. Everyone you invite can do everything you can. Nobody can remove their own access, and the last remaining account cannot be removed — that is what stops a business locking itself out.
Full documentation
The technical reference, including the parts written for manufacturers. Opens in a new tab.
Anything about pricing, products or approvals goes to your SourceRX contact rather than the documentation.
Your business
Settings.
Who at your business can sign in.
Invite a teammate
They get their own sign-in and can do everything you can — build the storefront, place orders and manage clients.
✓ Invitation sent
Give this password. It is shown once and cannot be recovered.
Who can sign in
You cannot remove your own access, and the last remaining account cannot be removed — that is what stops a business locking itself out.
Your account
Profile.
Your name as it appears to everyone else, and the password you sign in with.
Details
Your email address and access level are set by an administrator and cannot be changed here.
⚠ This account is set by the environment
The owner login comes from OWNER_EMAIL and OWNER_PASSWORD, and is re-applied on every boot. Editing it here would be undone at the next deploy, so the server refuses the change rather than appearing to accept it. Change those variables in Railway and redeploy.
The upside: if the owner password is ever lost, editing the environment and restarting is the way back in.
Change password
At least 12 characters. Every other browser signed in as you is signed out; this one stays.
SourceRX support
What works, and what doesn't.
Everything below is accurate as of this build — no button is decorative, but several are deliberately simulated.
The admin side is saved. Accounts, sessions, the product catalog, payment configuration, partners, manufacturers, applications, storefronts, orders and clients are all held in Postgres by the API and survive a reload, a redeploy and a different browser. What remains simulated is listed on the right — those are features that were never built, not data that is being lost.
Real, and saved by the API
Backed by the database. Survives a reload, a redeploy, and a different browser.
✓Sign-in is real authentication. The password is checked against a scrypt hash by the API; the session is a row in the database behind an HttpOnly cookie, so signing out revokes it immediately.
✓Employee and admin accounts. Created from Settings → Team with a one-time password, and role changes end that person's sessions immediately.
✓Your own profile. Change your name and password from the avatar. Changing a password signs out every other browser and keeps the one you are using.
✓Outbound email through Resend. New accounts and password resets are emailed sign-in details. Both messages can be test-sent to yourself from Settings.
✓The product catalog. Nine categories, products with per-size variants, and a price per size per tier across two independent schedules.
✓Bulk price import. A whole sheet at once, idempotent, with a dry run that reports what would change before anything does.
✓Payment processor configuration. The gateway credential is encrypted before storage and never returned to any page — reads show only its last four digits.
✓Partners, manufacturers and the application queue
✓Partner logins, and a partner's own team. Real accounts bound to the partner record, emailed their sign-in details. A partner invites its own staff from its settings without an administrator; every teammate is a peer, nobody can remove themselves, and the last account that can sign in cannot be removed. They see only that partner — not the directory, the catalog, or anyone else's orders and clients. Suspending the partner locks the whole team out immediately; deleting it removes them.
✓Public application form → review queue → approve, which creates the partner
✓Product availability by partner type
✓An audit trail of every access and money-configuration change
✓Public storefronts. An approved partner's store is live at its own address, showing the products they chose at the prices they set — under their name, logo and colour, with no mention of SourceRX anywhere on it.
✓A basket and a checkout. A customer can browse, add, and place an order with a delivery address. Prices are looked up server-side, never taken from the page, and a product another partner sells is not purchasable through this one.
✓Payments are connected. The processor authenticates, a payment is recorded against an order, and a signed webhook settles it. A forged one does not — an unsigned or wrongly-signed notification leaves the payment pending.
✓Nothing ships until the money arrives. An order is released to a manufacturer by a settled payment, not by anyone filling in a form, and a redelivered notification does not send a second parcel.
✓Manufacturer catalogs are read hourly. A supplier publishes a URL; we fetch it, match it to the shared catalog, and record what they can fill and how much they hold. A failed read is recorded against them rather than mistaken for silence.
✓Orders reach the manufacturer, tracking comes back. Each line goes to whoever can actually supply it, under their own code, with no pricing and no partner identity attached. They report the carrier and tracking number back.
✓The customer is emailed, as the partner. Order confirmation on settlement and tracking on despatch, carrying the partner's name, logo and colour, replying to the partner's address.
✓A merchant account per partner. A customer's bank statement names the shop they bought from, not the platform underneath it.
Also real, and saved
The partner workspace. These moved out of browser memory and into the database.
✓Storefront build → submit → approve or request changes. The selection, the DBA and the review state all persist.
✓Ordering and order history. Each line records what the unit cost and what it sold for at the moment it was placed, so changing a markup later does not rewrite an old order's margin.
✓Clients. Name, stage, spend and recurring revenue.
✓Pricing tiers. A partner holds one tier per schedule, and their cost basis is the catalog price at that tier.
✓Markup and derived partner pricing. Saved when the pricing is activated.
✓Every filter, metric and chart — real arithmetic over real stored data
✓Admin viewing any partner's workspace
Cost basis and markup are still sent to the browser for any signed-in admin, so they are visible in devtools to anyone with an admin session. They are no longer visible to a signed-out visitor.
Not built
Kept honest deliberately. Everything above this line works against real services; everything below does not exist yet, and is listed so nobody discovers it at an inconvenient moment.
!Checkout does not hand off to the payment page. The processor is connected and answering, the ledger records payments, and a settled payment releases an order — but the storefront still stops at "reserved" instead of sending the customer to pay. Until that is joined up, no card is charged. It is the one thing standing between the platform and a real transaction.
!Products have no images or descriptions. A storefront lists a compound, a size and a price. There is nowhere to put a photograph or a paragraph, so a customer is buying from a bare line item.
!Orders a partner places themselves send no confirmation. A customer buying through a storefront is emailed when their payment settles. An order a partner enters in their own workspace owes nothing at the point of ordering, never settles, and so triggers nothing.
!Refunds are recorded, not initiated. When the processor reports a refund we write it against the payment and the order. There is no button here that asks them to make one.
!Storefronts have no custom domains. A partner's store lives at a path on this domain, not at one of their own.