# Configuration

URL: https://zerodev.ca/docs/kora/extensions/core/configuration

> Key format, license statuses, validation rules, offline licenses, access rules and leak detection.



Find these under **Configs > Core > Licenses**.

## Keys

| Setting            | Default                   | What it does                                                                                 |
| ------------------ | ------------------------- | -------------------------------------------------------------------------------------------- |
| License key format | Standard                  | The shape of new keys: Standard (`XXXXX-XXXXX-XXXXX-XXXXX`), Short, UUID, Compact or Custom. |
| Custom format      | `XXXXX-XXXXX-XXXXX-XXXXX` | The pattern used when the format is Custom.                                                  |

## Statuses

Each status has a **Name**, an **ID**, a **Type** and a **Message**. A positive status passes validation and a negative one fails it with its message.

| Name      | ID          | Type     | Message                        |
| --------- | ----------- | -------- | ------------------------------ |
| Active    | `active`    | Positive | This license is valid.         |
| Suspended | `suspended` | Negative | This license is suspended.     |
| Revoked   | `revoked`   | Negative | This license has been revoked. |

Add your own, such as a `trial` status that passes or a `chargeback` status that fails. The ID of a negative status is returned as the result `code`.

## Validation

| Setting                                      | Default | What it does                                                                              |
| -------------------------------------------- | ------- | ----------------------------------------------------------------------------------------- |
| Require the product on every request         | On      | Requests without `product_name` fail with `missing_product`.                              |
| Require an API token with the validate scope | Off     | Only callers with a token holding `licenses.validate` can check keys.                     |
| Grace period after expiry (hours)            | 0       | How long a license keeps working after it expires.                                        |
| Activate new devices on validation           | Off     | Every validation also takes a free whitelist seat, like `POST /api/v1/licenses/activate`. |
| Keep validation logs (days)                  | 30      | How long validation logs are kept. `0` keeps them forever.                                |

## Offline Licenses

| Setting                     | Default | What it does                                                                      |
| --------------------------- | ------- | --------------------------------------------------------------------------------- |
| Allow offline license files | On      | Lets staff and customers download signed offline license files.                   |
| Refresh after (days)        | 30      | How long a downloaded file is trusted before the product must check online again. |

## Access Rules

| Setting                           | Default        | What it does                                                                                                                      |
| --------------------------------- | -------------- | --------------------------------------------------------------------------------------------------------------------------------- |
| Country header                    | `cf-ipcountry` | A proxy header with the visitor's country. Used before the geo database when present. Leave empty to always use the geo database. |
| Update the geo database monthly   | On             | Downloads the newest DB-IP country database on the 3rd of each month.                                                             |
| Show countries in validation logs | On             | Stores the country of each request in the validation log.                                                                         |

## Leak Detection

| Setting                             | Default   | What it does                                                  |
| ----------------------------------- | --------- | ------------------------------------------------------------- |
| Flag keys used from too many places | On        | Turns leak detection on.                                      |
| Window (hours)                      | 24        | How far back Kora looks.                                      |
| Max IP addresses                    | 5         | Different IPs allowed in the window.                          |
| Max devices                         | 3         | Different `hwid` values allowed in the window.                |
| Action                              | Flag only | **Flag only**, or **Flag and change status**.                 |
| Status                              | Suspended | The negative status given when the action changes the status. |