PayTR rejects merchant_oid with non-alphanumeric chars. Real Appwrite tenant IDs are hex (a-z0-9) and safe, but demo-tenant-001 contains hyphens. Encode - as Z (never appears in Appwrite hex IDs) in the merchantOid; decode back in the callback.