Introducing Kora 2.0

Kora 2.0 is a rebuild from the ground up. It runs on the same module system as Medusa, the dashboard is part of Kora itself, and setup happens in your browser instead of in a config file.

Here is what changed.

The Dashboard Is Built In

The dashboard runs inside Kora on port 3000, and the API runs on port 3001. There is no second app to host and nothing to build.

Everyone signs in with Discord. The owner of your Kora license gets full access, staff get the permissions of their role, and customers land on the client dashboard.

It has pages for licenses, products, addons, customers, whitelists and validation logs, plus:

• Integration, with your request URL, your public key, ready-to-paste code and a live key tester.
• Team members and Roles, so support staff only see what they need.
• Audit Log for every change, whether it came from staff, an API token or Kora itself.
• API Tokens with scopes for the management API.
• Lang, to edit any text a module shows, in 16 languages.
• Logs, with the live console.

Press Ctrl K or ⌘K to search licenses, products, customers and members from anywhere.

Setup in the Browser

The first start opens a setup wizard. You enter your Kora license key, your database details and a Discord application for sign-in, and pick a name and accent color. Kora then connects to the database, activates the license, loads its modules and checks for updates, showing each stage with the live console. When it finishes you sign in. There is no restart.

The Discord account on your license becomes the dashboard owner.

Settings Live in Your Database

config.json now holds only what Kora needs to start: the sign-in secret, the database connection, the ports and the public URLs. The wizard fills it in for you.

Everything else is stored in your database and changed from the dashboard:

• Settings for language, appearance, sign-in, updates and the client dashboard.
• Configs for each module's settings.

Settings > Transfer Options exports your settings to a file and imports them on another install.

Signed Responses

Every validation response is signed with an Ed25519 key, in the x-kora-signature header. Put the public key in your product and check the signature, and nobody can point your product at a fake server that always says yes.

Get the public key from Settings > Response Signing Key or from GET /api/v1/public-key.

Keeping Keys Where They Belong

• Whitelists limit where a key works, by IP, a request header or a request body field such as a hardware ID.
• Leak detection flags a key when it is checked from more IPs or devices than you allow in a time window, and can suspend it.
• Validation logs record every request with its key, product, result, IP and device.
• License statuses are yours to define, such as Suspended or Revoked, and each one returns its own code.

Modules

Everything in Kora 2.0 is a module. Three ship with it:

• Core: licenses, products, customers, addons, whitelists and the validation endpoint.
• BuiltByBit: reads your resources and purchases, creates a customer for each buyer, issues their license, can revoke it on a refund, and fills license key placeholders.
• Discord: slash commands for staff, /mylicenses for customers, a validation log channel and live numbers in the bot's status.

You can write your own. A module can add config, lang files, commands, dashboard pages, API routes, events, models and timed jobs. See the developer docs.

Client Dashboard

Customers sign in with Discord at your dashboard address. They see their own licenses and keys, add and remove their own whitelist entries up to the limit you set, and see the activity on each key. Turn it off under Settings > Client Dashboard.

Official SDKs

The zerodev-ca/Kora-SDKs repository has an SDK for each platform:

Each one checks keys, verifies the signature when you give it the public key, and can manage licenses, products and customers with an API token.

import { Client } from "@zerodev-ca/kora";

const kora = new Client({ url: "https://kora.example.com", product: "Test Product 1", publicKey: process.env.KORA_PUBLIC_KEY });

const result = await kora.validate(licenseKey);
if (!result.valid) throw new Error(result.message);

See the SDK docs for Java, Python and FiveM.

Updates

Settings > Updates shows your version and the newest one. Click Update to install it, or turn on Automatic Updates to install new versions when Kora restarts.

Getting Kora 2.0

Kora 2.0 is a fresh install. Download it from BuiltByBit, create an empty PostgreSQL, MySQL or MariaDB database and follow the setup guide. You need Node.js 20 or newer, or Bun.