# Configuration

Source: https://kart.bnomei.com/docs/setup/configuration
Updated: 2025-12-04T19:23:02+00:00
Summary: Configure Bnomei Kart plugin for Kirby CMS: license, crypto, captcha, currency, customers, orders, products, middleware, router, stock & provider settings.

## Required Settings

Path: config/config.php  
Code (php):  
```
<?php

return [
  // required for production
  'bnomei.kart.license' => fn() => env('KART_LICENSE_KEY'),

  // recommended, set a random 64 char long string to these
  // and keep the values save like you would with a password
  'bnomei.kart.crypto.password' => fn() => env('CRYPTO_PASSWORD'),
  'bnomei.kart.crypto.salt' => fn() => env('CRYPTO_SALT'), // -> signatures for order URLs
];
```

  
## All Settings

<table><thead><tr><th>bnomei.kart.</th><th>Default</th><th>Description</th></tr></thead><tbody><tr><td>license</td><td>`callback|string`</td><td>the Kart plugin license key</td></tr><tr><td>captcha.enabled</td><td>`false`</td><td>enable if you want to use it</td></tr><tr><td>captcha.current</td><td>`string`</td><td></td></tr><tr><td>captcha.get</td><td>`string`</td><td></td></tr><tr><td>captcha.set</td><td>`callback|string`</td><td></td></tr><tr><td>checkoutFormData</td><td>`callback`</td><td>callback to validate/modify the data of the checkout form, can yield a 302 HTTP status code</td></tr><tr><td>completed</td><td>`callback`</td><td>callback to modify the data for the order creation</td></tr><tr><td>crypto.password</td><td>`callback|null|false`</td><td>string with password for the encryption or disable</td></tr><tr><td>crypto.salt</td><td>`callback`</td><td>string with salt for the encryption with fallback to random in cache</td></tr><tr><td>crypto.signature</td><td>`true`</td><td>append and check signature on critical Urls like MagicLinks and Order pages</td></tr><tr><td>currency</td><td>`'EUR'`</td><td>uppercase 3-letter code</td></tr><tr><td>customers.enabled</td><td>`true`</td><td>automatically create users</td></tr><tr><td>customers.roles</td><td>`['customer', 'member', 'admin']`</td><td>possible roles with first one being default</td></tr><tr><td>dateformat</td><td>`Y-m-d H:i`</td><td>used within the blueprints for the panel, adjust this when using the IntlDateHandler</td></tr><tr><td>expire</td><td>`0|null`</td><td>create caches, expire in minutes or disable</td></tr><tr><td>licenses.api</td><td>`false`</td><td>CSRF protected API endpoints to manipulate licenses</td></tr><tr><td>licenses.activate</td><td>`callback`</td><td>customize the license endpoint</td></tr><tr><td>licenses.deactivate</td><td>`callback`</td><td>customize the license endpoint</td></tr><tr><td>licenses.validate</td><td>`callback`</td><td>customize the license endpoint</td></tr><tr><td>locale</td><td>`callback|string`</td><td>or current locale on multilanguage setups</td></tr><tr><td>middleware.blacklist</td><td>`array`</td><td>list of paths used by Kart that should be disabled</td></tr><tr><td>middleware.csrf</td><td>`'token'`</td><td>null/false or name for form field</td></tr><tr><td>middleware.enabled</td><td>`array`</td><td>list of enabled middlewares, csrf and ratelimit by default</td></tr><tr><td>middleware.ratelimit.enabled</td><td>`true`</td><td>protects public facing endpoints</td></tr><tr><td>middleware.ratelimit.limit</td><td>`60`</td><td>max 60 requests per minute</td></tr><tr><td>orders.enabled</td><td>`true`</td><td>create orders page and enable order management</td></tr><tr><td>orders.order.create-missing-zips</td><td>`true`</td><td>if any product in order has downloads and the order has no zip then recreate it on next access</td></tr><tr><td>orders.order.maxapo</td><td>`10`</td><td>max amount product per order unless specified on product itself, keep this low to prevent stock hostages, set per product instead</td></tr><tr><td>orders.order.maxlpo</td><td>`10`</td><td>max different products per order aka lines in cart, check your providers API docs before increasing this</td></tr><tr><td>orders.order.uuid</td><td>`callback`</td><td>generator for order page Uuids (not invoice number)</td></tr><tr><td>orders.order.zip</td><td>`callback`</td><td>callback to add/remove files to the directory used to create the ZIP file for an order</td></tr><tr><td>orders.page</td><td>`'orders'`</td><td>slug of the orders page</td></tr><tr><td>products.enabled</td><td>`true`</td><td>create the products page if missing and use within Kart</td></tr><tr><td>products.page</td><td>`'products'`</td><td>slug of the products page</td></tr><tr><td>products.product.uuid</td><td>`callback`</td><td>generator for product page Uuids</td></tr><tr><td>products.variants</td><td>`array`</td><td>2-dimensional array to define sorting order of variants for $product-&gt;variantGroups()</td></tr><tr><td>provider</td><td>`'kirby_cms'|string`</td><td>key of current provider, see ProviderEnum</td></tr><tr><td>providers</td><td>`array`</td><td>list of all providers with an array of config for each, see each Provider in the docs</td></tr><tr><td>queues.locking</td><td>`true`</td><td>use a locking queue for updating stock</td></tr><tr><td>router.csrf</td><td>`'token'`</td><td>null/false or name of form field</td></tr><tr><td>router.header.csrf</td><td>`'X-CSRF-TOKEN'`</td><td>accept this header as for csrf value, see headless setup</td></tr><tr><td>router.header.htmx</td><td>`'HX-Request'`</td><td>if present then router will change mode to html, see HATEOAS setup</td></tr><tr><td>router.mode</td><td>`'go'`</td><td>go/json/html, defines what Karts router returns</td></tr><tr><td>router.salt</td><td>`callback|false`</td><td>KEQ, string with salt for the encryption with fallback to random in cache or disable</td></tr><tr><td>router.snippets</td><td>`array`</td><td>array of snippet names or from-&gt;to mappings for headless and HATEOAS setups</td></tr><tr><td>stocks.enabled</td><td>`true`</td><td>create stocks page and enable stock management</td></tr><tr><td>stocks.page</td><td>`'stocks'`</td><td>slug of the stocks page</td></tr><tr><td>stocks.queue</td><td>`true`</td><td>use a queue to prevent issues with concurrent requests</td></tr><tr><td>stocks.stock.uuid</td><td>`callback`</td><td>generator for stock page Uuids</td></tr><tr><td>successPage</td><td>`null`</td><td>id of the page to redirect to after checkout flow, defaults to page of order</td></tr><tr><td>turnstile.secretkey</td><td>`callback|string`</td><td></td></tr><tr><td>turnstile.sitekey</td><td>`callback|string`</td><td></td></tr></tbody></table>

Make sure you website is [secure](https://kart.bnomei.com/docs/data/security).