diff --git a/app/Http/Controllers/Pargar/PargarInboundController.php b/app/Http/Controllers/Pargar/PargarInboundController.php
index 25d9505..61b4aaf 100644
--- a/app/Http/Controllers/Pargar/PargarInboundController.php
+++ b/app/Http/Controllers/Pargar/PargarInboundController.php
@@ -35,11 +35,10 @@ class PargarInboundController extends Controller
             ], 503);
         }
 
-        $username = (string) $request->input('username', '');
-        $password = (string) $request->input('password', '');
+        [$username, $password] = $this->pargarLoginCredentials($request);
 
-        $expectedUser = trim((string) $this->Config('pargar_username'));
-        $expectedPass = trim((string) $this->Config('pargar_password'));
+        $expectedUser = $this->normalizeCredential(trim((string) $this->Config('pargar_username')));
+        $expectedPass = $this->normalizeCredential(trim((string) $this->Config('pargar_password')));
 
         if ($username !== $expectedUser || $password !== $expectedPass || $expectedUser === '') {
             return response()->json([
@@ -389,6 +388,37 @@ class PargarInboundController extends Controller
         ]);
     }
 
+    /**
+     * @return array{0: string, 1: string}
+     */
+    private function pargarLoginCredentials(Request $request): array
+    {
+        $username = (string) $request->input('username', '');
+        $password = (string) $request->input('password', '');
+
+        if ($username === '' && $password === '') {
+            $payload = json_decode((string) $request->getContent(), true);
+            if (is_array($payload)) {
+                $username = (string) ($payload['username'] ?? '');
+                $password = (string) ($payload['password'] ?? '');
+            }
+        }
+
+        return [
+            $this->normalizeCredential($username),
+            $this->normalizeCredential($password),
+        ];
+    }
+
+    private function normalizeCredential(string $value): string
+    {
+        $persian = ['۰', '۱', '۲', '۳', '۴', '۵', '۶', '۷', '۸', '۹'];
+        $arabic = ['٠', '١', '٢', '٣', '٤', '٥', '٦', '٧', '٨', '٩'];
+        $latin = ['0', '1', '2', '3', '4', '5', '6', '7', '8', '9'];
+
+        return trim(str_replace(array_merge($persian, $arabic), array_merge($latin, $latin), $value));
+    }
+
     private function uniqueReferralId(): string
     {
         do {
diff --git a/scripts/test-pargar-api.sh b/scripts/test-pargar-api.sh
new file mode 100755
index 0000000..d5f72fd
--- /dev/null
+++ b/scripts/test-pargar-api.sh
@@ -0,0 +1,171 @@
+#!/usr/bin/env bash
+# تست کامل API پرگار روی سرور production
+# استفاده:
+#   PARGAR_USER=your_user PARGAR_PASS=your_pass ./scripts/test-pargar-api.sh
+# یا:
+#   PARGAR_TOKEN=your_static_token ./scripts/test-pargar-api.sh
+
+set -euo pipefail
+
+BASE_URL="${PARGAR_BASE_URL:-https://kh.kashkolgold.ir/server/pargar}"
+PARGAR_USER="${PARGAR_USER:-}"
+PARGAR_PASS="${PARGAR_PASS:-}"
+PARGAR_TOKEN="${PARGAR_TOKEN:-}"
+
+ACCOUNT_ID="${TEST_ACCOUNT_ID:-123}"
+TEST_MOBILE="${TEST_MOBILE:-09120000000}"
+TEST_NAME="${TEST_NAME:-علی اکبری تست}"
+
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+NC='\033[0m'
+
+step() { echo -e "\n${YELLOW}=== $1 ===${NC}"; }
+ok() { echo -e "${GREEN}✓ $1${NC}"; }
+fail() { echo -e "${RED}✗ $1${NC}"; exit 1; }
+
+request() {
+  local method="$1" path="$2" body="${3:-}" auth="${4:-}"
+  local args=(-sS -w "\n__HTTP__:%{http_code}" -X "$method" "${BASE_URL}${path}" -H "Content-Type: application/json")
+  if [[ -n "$auth" ]]; then
+    args+=(-H "Authorization: Bearer ${auth}")
+  fi
+  if [[ -n "$body" ]]; then
+    args+=(-d "$body")
+  fi
+  curl "${args[@]}"
+}
+
+print_result() {
+  local raw="$1"
+  local http
+  http=$(echo "$raw" | sed -n 's/.*__HTTP__:\([0-9]*\)$/\1/p')
+  local body
+  body=$(echo "$raw" | sed 's/__HTTP__:[0-9]*$//')
+  echo "HTTP: $http"
+  echo "$body" | python3 -m json.tool 2>/dev/null || echo "$body"
+  echo "$http"
+}
+
+# --- 1. Login ---
+step "1) POST /login"
+if [[ -z "$PARGAR_TOKEN" ]]; then
+  [[ -n "$PARGAR_USER" && -n "$PARGAR_PASS" ]] || fail "PARGAR_USER و PARGAR_PASS یا PARGAR_TOKEN لازم است"
+  RAW=$(request POST "/login" "{\"username\":\"${PARGAR_USER}\",\"password\":\"${PARGAR_PASS}\"}")
+  HTTP=$(print_result "$RAW")
+  [[ "$HTTP" == "200" ]] || fail "login ناموفق (HTTP $HTTP)"
+  PARGAR_TOKEN=$(echo "$RAW" | sed 's/__HTTP__:[0-9]*$//' | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('data',{}).get('token',''))" 2>/dev/null || true)
+  [[ -n "$PARGAR_TOKEN" ]] || fail "توکن از login دریافت نشد"
+  ok "توکن دریافت شد: ${PARGAR_TOKEN:0:16}..."
+else
+  ok "از PARGAR_TOKEN استفاده می‌شود"
+fi
+
+# --- 2. Customers ---
+step "2) POST /customers"
+BODY=$(cat <<EOF
+{
+  "Customers": [
+    {
+      "AccountId": "${ACCOUNT_ID}",
+      "FullName": "${TEST_NAME}",
+      "CellPhone": "${TEST_MOBILE}"
+    }
+  ]
+}
+EOF
+)
+RAW=$(request POST "/customers" "$BODY" "$PARGAR_TOKEN")
+HTTP=$(print_result "$RAW")
+[[ "$HTTP" == "200" ]] || fail "customers ناموفق"
+
+# --- 3. Orders ---
+step "3) GET /orders"
+RAW=$(request GET "/orders" "" "$PARGAR_TOKEN")
+HTTP=$(print_result "$RAW")
+[[ "$HTTP" == "200" ]] || fail "orders ناموفق"
+ORDER_ID=$(echo "$RAW" | sed 's/__HTTP__:[0-9]*$//' | python3 -c "
+import sys,json
+d=json.load(sys.stdin)
+docs=d.get('data',{}).get('documents',[])
+print(docs[0]['OrderId'] if docs else '')
+" 2>/dev/null || true)
+
+# --- 4. Confirm orders ---
+step "4) POST /orders (confirm)"
+if [[ -n "$ORDER_ID" ]]; then
+  RAW=$(request POST "/orders" "{\"OrderIds\":[\"${ORDER_ID}\"]}" "$PARGAR_TOKEN")
+  HTTP=$(print_result "$RAW")
+  [[ "$HTTP" == "200" ]] || fail "confirm orders ناموفق"
+else
+  echo "سفارش تاییدنشده‌ای نبود — این مرحله رد شد"
+fi
+
+# --- 5. Documents ---
+step "5) POST /documents"
+BODY=$(cat <<EOF
+{
+  "accountName": "${TEST_NAME}",
+  "accountId": "${ACCOUNT_ID}",
+  "transactions": [
+    {
+      "docId": "999001",
+      "date": "1404-10-03",
+      "docType": "تست",
+      "desc": "تست اسکریپت",
+      "by": "script",
+      "goldState": "",
+      "rialState": "",
+      "bedGold": 0,
+      "besGold": 0,
+      "bedRial": 0,
+      "besRial": 0,
+      "remainGold": 0,
+      "remainRial": 0
+    }
+  ]
+}
+EOF
+)
+RAW=$(request POST "/documents" "$BODY" "$PARGAR_TOKEN")
+HTTP=$(print_result "$RAW")
+[[ "$HTTP" == "200" ]] || fail "documents ناموفق"
+
+# --- 6. Mande ---
+step "6) POST /mande"
+BODY=$(cat <<EOF
+{
+  "AccountId": "${ACCOUNT_ID}",
+  "GoldInv": 1.5,
+  "RialInv": 1000000
+}
+EOF
+)
+RAW=$(request POST "/mande" "$BODY" "$PARGAR_TOKEN")
+HTTP=$(print_result "$RAW")
+[[ "$HTTP" == "200" ]] || fail "mande ناموفق"
+
+# --- 7. GetCustomers ---
+step "7) GET /GetCustomers"
+RAW=$(request GET "/GetCustomers" "" "$PARGAR_TOKEN")
+HTTP=$(print_result "$RAW")
+[[ "$HTTP" == "200" ]] || fail "GetCustomers ناموفق"
+CUSTOMER_ID=$(echo "$RAW" | sed 's/__HTTP__:[0-9]*$//' | python3 -c "
+import sys,json
+d=json.load(sys.stdin)
+rows=d.get('customer',[])
+print(rows[0]['id'] if rows else '')
+" 2>/dev/null || true)
+
+# --- 8. CustomerConfirm ---
+step "8) POST /CustomerConfirm"
+if [[ -n "$CUSTOMER_ID" ]]; then
+  RAW=$(request POST "/CustomerConfirm" "{\"customers\":[{\"customer_id\":\"${CUSTOMER_ID}\",\"accounting_id\":\"${ACCOUNT_ID}99\"}]}" "$PARGAR_TOKEN")
+  HTTP=$(print_result "$RAW")
+  [[ "$HTTP" == "200" ]] || fail "CustomerConfirm ناموفق"
+else
+  echo "مشتری جدید بدون کد پرگار نبود — این مرحله رد شد"
+fi
+
+echo -e "\n${GREEN}=== همه تست‌ها تمام شد ===${NC}"