Configuration

Every setting Kora uses lives in config/config.json at the root of your Kora folder. This page explains what each one does.

New to Kora? Start with the Setup Guide; it walks you through the essential settings. This page is the complete reference for when you want to fine‑tune things.

How the config file works

It's created for you. The first time you start Kora, config/config.json is generated with sensible defaults.
It fixes itself. Every time Kora starts, it checks the file. Anything missing is added back with its default, and if the file ever becomes unreadable it's rebuilt from scratch, so you can't break Kora by leaving a setting out.
Changes apply on restart. Edit the file, save it, and restart Kora for your changes to take effect.

The file's top‑level sections are LICENSE, KORA, AUTHENTICATION, DASHBOARD, SMTP, CLIENT_DASHBOARD, and DATABASE.

LICENSE

Setting	Description
`AGREE_TO_LICENSE.MD`	Must be `true` for Kora to start. Setting it to `true` means you accept the license.
`LICENSE_KEY`	Your Kora license key, from a ticket in the Zero Development Discord. Verified on startup, so Kora needs internet access.

KORA

The main settings for the app itself.

Setting	Default	Description
`PORT`	`3000`	The port Kora listens on. It must be free and different from `DASHBOARD.PORT`. Kora now refuses to start if the port is already taken instead of failing silently.
`URL`	`""`	The public URL of your Kora server (for example `https://api.yoursite.com`). It is the address your customers' integrations call (see the Core API Reference). Leave empty to fall back to `http://localhost:<PORT>`.
`ENVIRONMENT`	`NODEJS`	How you're running Kora: `NODEJS` or `BUN`.
`AUTO_UPDATE`	`true`	Automatically download and install updates on startup (also downloads the dashboard add‑on).
`TRUST_PROXY`	`""`	Set this when Kora runs behind a reverse proxy so it reads the correct visitor address. Use `"1"` for a single proxy, `"true"` to trust all, or leave empty to disable.

KORA.CONSOLE

Controls the console output and the built‑in command line.

Setting	Default	Description
`SECONDS`	`false`	Include seconds in log timestamps.
`12_HOURS`	`true`	Use 12‑hour (`true`) or 24‑hour (`false`) timestamps.
`DEBUG`	`false`	Show extra, detailed logging. Turn on only when troubleshooting.
`CLI`	`true`	Enable the interactive command line in the console. Turn this off for hosts without an interactive console.

KORA.API_KEY

A list of secret keys that authorize requests to Kora's management API. The dashboard uses the first key to talk to Kora.

"API_KEY": [
    { "NAME": "Default", "VALUE": "keep-this-secret" }
]

NAME: a label for the key (used in logs and rate limiting).
VALUE: the secret itself. A random one is generated for you on first run.

Treat these keys like passwords. Give separate integrations their own named keys so you can manage them independently.

KORA.RATELIMIT

Limits how many API requests a single key can make, to protect your instance.

Setting	Default	Description
`TIMEFRAME`	`5s`	The time window that requests are counted in.
`REQUESTS`	`50`	The most requests a key may make within that window.
`COOLDOWN`	`60s`	How long a key is blocked after going over the limit.

Durations are written as a number plus a unit: ms, s, m, or h (for example, 60s or 5m).

AUTHENTICATION

Who can sign in to the dashboards, and how. Walked through in the Dashboard Setup Guide. Every sign‑in method is optional; turn on the ones you want.

Setting	Default	Description
`DISCORD_ID` / `DISCORD_SECRET`	`""`	Discord OAuth app credentials.
`GOOGLE_ID` / `GOOGLE_SECRET`	`""`	Google OAuth app credentials.
`GITHUB_ID` / `GITHUB_SECRET`	`""`	GitHub OAuth app credentials.
`EMAIL_PASSWORD`	`true`	Allow signing in with an email and password.
`AUTH_SECRET`	(auto)	A sign‑in secret generated for you. Leave it as is.
`ADMINS`	`[]`	The accounts allowed to sign in. Each entry is `{ "PROVIDER": "...", "VALUE": "..." }`, where `PROVIDER` is `discord`, `google`, or `github`, and `VALUE` is the matching user ID, email, or username.

Magic sign‑in links and password‑reset emails also need the SMTP section below.

DASHBOARD

Settings for the optional web dashboard add‑on. These are covered step by step in the Dashboard Setup Guide.

Setting	Default	Description
`ENABLE`	`true`	Start the dashboard (when your license includes the add‑on and it's been downloaded).
`DEV_MODE`	`false`	Run the dashboard in development mode with live reload. For local development only.
`PORT`	`3001`	The port the dashboard runs on. Must be different from `KORA.PORT`.
`URL`	`http://localhost:3001`	The public address people use to reach the dashboard.

DASHBOARD.CUSTOMIZE

Branding and integration details shown in the dashboard.

Setting	Default	Description
`BRAND_NAME`	`Kora`	Your product or company name.
`ICON`	(Zero Development logo)	A URL to your logo. Also used as the dashboard's favicon.
`ACCENT_COLOR`	`#4DABF7`	A hex color used for buttons, links, highlights, and the brand and sign-in gradients.
`THEME`	`dark`	The dashboard color scheme: `dark`, `light`, or `auto` (follow the visitor's system setting).
`RADIUS`	`md`	How rounded the dashboard's corners are: `xs`, `sm`, `md`, `lg`, or `xl`.
`FONT`	`""`	A font family for the dashboard interface (for example `Inter`). Leave empty to use the default.
`CUSTOM_CSS`	`""`	Extra CSS injected into every dashboard page for fine‑grained styling. Leave empty for none.

SMTP

Outgoing email, used for the dashboard's magic sign‑in links and password‑reset emails. Leave HOST empty to disable those features (other sign‑in methods keep working).

Setting	Default	Description
`HOST`	`""`	Your SMTP server host. Setting this turns email features on.
`PORT`	`587`	The SMTP port.
`SECURE`	`false`	Use a TLS connection (usually `true` for port `465`).
`USER`	`""`	The SMTP username.
`PASSWORD`	`""`	The SMTP password.
`FROM`	`""`	The address emails are sent from.

An optional separate portal where your customers sign in to see and manage their own licenses. It shares the AUTHENTICATION settings and takes the same branding options as the admin dashboard. Set up step by step in the Client Dashboard Setup Guide.

Setting	Default	Description
`ENABLE`	`false`	Start the client dashboard.
`DEV_MODE`	`false`	Run it in development mode with live reload. For local development only.
`PORT`	`3002`	The port it runs on. Must differ from `KORA.PORT` and `DASHBOARD.PORT`.
`URL`	`http://localhost:3002`	The public address customers use to reach it.
`REDEEM_PAGE`	`false`	Show a page where customers can redeem an unclaimed key.
`CUSTOMIZE`	(defaults)	Branding, the same options as `DASHBOARD.CUSTOMIZE`.

DATABASE

Where Kora stores all of its data.

Setting	Default	Description
`TYPE`	`POSTGRES`	Your database type: `POSTGRES`, `MYSQL`, or `MARIADB`. Kora installs the right driver automatically.
`HOST`	`localhost`	The database server address.
`PORT`	`5432`	The database server port.
`USER`	`admin`	The username Kora connects with.
`PASSWORD`	`password`	The password Kora connects with.
`DATABASE`	`Kora`	The name of the database to use. It must already exist.
`MIGRATE`	`true`	Keep Kora's tables up to date automatically. Recommended to leave on.

Kora creates its tables inside the database you point it at, but it does not create the database itself, so make sure the database named in DATABASE already exists.

Advanced: customizing licenses & records

Beyond the main file, Kora keeps a few extra config files in the config/core/ folder that let you tailor how licenses and records work. You usually won't need to touch these, but they're there when you do:

File	What it controls
`licenses.json`	The format of generated license keys (for example `XXXXX-XXXXX-XXXXX-XXXXX`, where each `X` becomes a random character).
`customers.json`	Extra fields stored on each customer (such as an email or Discord ID).
`products.json`	Extra fields on each product, plus reusable product templates.
`addons.json`	Extra fields stored on each add‑on (such as a price).

These files are created automatically and self‑heal just like the main config. Restart Kora after editing them.

Configuration

On this page