Dashboard Setup

The dashboard is an optional paid add‑on: a web admin panel for managing your licenses, products, customers, and more from your browser. This guide gets it running.

1. Claim the add-on

1. Buy the Dashboard add‑on ($8.99) on the BuiltByBit page.
2. In the Zero Development Discord, go to the 「🤖」commands channel and run /claim to apply the add‑on to your license key.

Your license now includes the Dashboard add‑on, so Kora can download and run the dashboard.

2. Download the dashboard

The dashboard files are delivered automatically. In config/config.json, make sure KORA.AUTO_UPDATE is set to true, then restart Kora. On startup Kora downloads the dashboard for you (only if your license includes the add‑on). You'll see it fetch the files in the console.

3. Set up sign-in

The dashboard signs admins in with one or more methods. Configure the ones you want in the top‑level AUTHENTICATION section of config/config.json:

• OAuth (Discord, Google, or GitHub): create an app with the provider, then paste its client ID and secret.
• Email and password: on by default, no external setup.
• Magic links and password resets: email based, enabled once you fill in SMTP.

You can turn on as many as you like. Whatever you enable, only the accounts listed in ADMINS can actually sign in (step 4).

OAuth providers

For each provider you use, create an app, copy its Client ID and Client Secret, and add the redirect URL below (swap in your dashboard's public URL).

Email sign-in (optional)

Email and password is on by default (AUTHENTICATION.EMAIL_PASSWORD); set it to false to turn it off. To send magic sign‑in links and password‑reset emails, fill in the top‑level SMTP section (HOST, PORT, USER, PASSWORD, FROM). Without SMTP those email links are simply unavailable; OAuth and password sign‑in still work.

4. Configure access

Fill in the top‑level AUTHENTICATION section (it sits alongside KORA and DASHBOARD, not inside them):

• The OAuth ID/secret pairs from step 3, for the providers you use.
• EMAIL_PASSWORD: true to allow email + password sign‑in.
• AUTH_SECRET: generated for you, leave it as is.
• ADMINS: the accounts allowed to sign in. Each entry is a PROVIDER and a VALUE:

"ADMINS": [
    { "PROVIDER": "discord", "VALUE": "your-discord-user-id" },
    { "PROVIDER": "google", "VALUE": "you@example.com" },
    { "PROVIDER": "github", "VALUE": "your-github-username" }
]

The VALUE depends on the provider: a Discord user ID, a Google account email, or a GitHub username.

Then set the DASHBOARD section (which no longer holds any auth settings):

• ENABLE: true.
• PORT: the port the dashboard runs on (default 3001).
• URL: the public address people use to reach it (must match your redirect URLs).

Your config should end up looking like this:

"AUTHENTICATION": {
    "DISCORD_ID": "your-application-client-id",
    "DISCORD_SECRET": "your-application-client-secret",
    "GOOGLE_ID": "",
    "GOOGLE_SECRET": "",
    "GITHUB_ID": "",
    "GITHUB_SECRET": "",
    "EMAIL_PASSWORD": true,
    "AUTH_SECRET": "leave-this-alone",
    "ADMINS": [
        { "PROVIDER": "discord", "VALUE": "your-discord-user-id" }
    ]
},
"DASHBOARD": {
    "ENABLE": true,
    "DEV_MODE": false,
    "PORT": 3001,
    "URL": "https://panel.example.com"
}

5. Restart Kora

Restart Kora to apply the changes. The first time the dashboard starts, Kora installs its dependencies and builds it, which can take a few minutes. You'll see a message when it's ready:

Dashboard started on port 3001

6. Open and sign in

Go to your dashboard URL in a browser and sign in with any method you enabled. As long as your account is in ADMINS, you'll land in the panel. Once you're in, you can turn on two‑factor authentication (an authenticator app) from your profile for an extra layer of security.

Appearance & branding

The dashboard reads its look from DASHBOARD.CUSTOMIZE in config/config.json, so you can make it match your own product. Set your logo and name, then tune the rest to taste:

• BRAND_NAME and ICON: the name and logo shown in the sidebar and browser tab.
• ACCENT_COLOR: a hex color used for buttons, links, highlights, and the brand and sign-in gradients.
• THEME: dark, light, or auto to follow the visitor's system setting.
• RADIUS: how rounded the corners are, from xs to xl.
• FONT: a font family for the interface, or empty for the default.
• CUSTOM_CSS: raw CSS injected into every page when you need finer control.

Changes apply the next time the dashboard starts. See the Configuration reference for the full list of options.

Running behind a proxy

If your dashboard is served over a public domain (through Nginx, Cloudflare, a load balancer, or a panel proxy), a few things matter:

• Set DASHBOARD.URL to the full public https address, since this is what OAuth sign‑in redirects back to.
• Set KORA.TRUST_PROXY (usually "1") so Kora reads the correct visitor address behind the proxy.
• Set KORA.URL to the public URL of your Kora API server. It is the address your customers' integrations call (see the Core API Reference), so they reach your server instead of localhost.

Troubleshooting

• The dashboard never starts / is skipped. Confirm you've claimed the Dashboard add‑on with /claim (step 1), DASHBOARD.ENABLE is true, and KORA.AUTO_UPDATE is true so the files download.
• Sign‑in fails or redirects to an error. Double‑check that DASHBOARD.URL exactly matches the redirect URL you added with the provider (including https:// and no trailing slash), and that the client ID and secret are correct.
• "You can't sign in." Make sure your account is in AUTHENTICATION.ADMINS with the right PROVIDER and a matching VALUE (Discord user ID, Google email, or GitHub username).
• Magic links or reset emails never arrive. Fill in the SMTP section; those features need it.