Calbok buyer documentation

For the self-hosted edition: These guides help buyers install and operate Calbok on their own server. If your business uses Calbok's hosted service, there is no package to install. Visit the hosted Calbok site instead.

Calbok is a white-label, multi-tenant appointment and practice-management platform you install on your own server and resell to businesses (salons, clinics, gyms, consultancies).

Online documentation: https://calbok.com/docs (also bundled as documentation/*.html in your download).
Live demo: https://demo.calbok.com (one-click persona logins; data resets nightly).

Who is who

Role	Also called	What they do
Operator	Licence holder (you)	You bought Calbok on CodeCanyon. You run the central `/admin` panel, create tenants, and configure platform-wide settings (SMTP, SaaS billing, licence).
Business	Tenant	Your customer — a business that books appointments. Owners and staff use `/app`.
Customer	End user	People who book on the public booking page.

Licence types (CodeCanyon)

Both licence types cover one Calbok end product, normally one production installation run by one Operator. Businesses using that installation are tenants of the same platform. A separate production installation for another Operator needs its own licence.

Regular licence: use that installation when businesses are not charged to access Calbok, such as for your own scheduling operation.
Extended licence: use that installation when you charge businesses to access Calbok, including a subscription to your SaaS platform. The number of tenant businesses does not turn one Calbok installation into multiple installations.

After activation, Admin Settings shows the licence type returned by Envato. If Envato does not report a recognised type, the screen says it is unavailable. Calbok cannot detect charges collected outside the app, so the Operator must choose the licence that matches how the platform is offered.

URLs and the `{tenant}` path segment

Every business has a short path slug (for example demo or acme-clinic). Public booking and many return URLs look like:

https://your-domain.com/{tenant}/book

Replace {tenant} with that slug. The business owner sees it in /app → Settings → Business profile (and on the booking-link widget). You set the slug when you create the business in Admin → Businesses. Webhook URLs use the same slug: https://your-domain.com/webhooks/booking/{tenant}/stripe/test (see Payments).

Before you start

Requirements

Item	Shared hosting (minimum)	VPS / dedicated
PHP	8.3+	8.3+
PHP extensions	bcmath, ctype, curl, fileinfo, json, mbstring, openssl, pdo, tokenizer, xml, pdo_mysql or pdo_pgsql	Same
Database	MySQL 8 or PostgreSQL 14+	Same
Queue / cache driver	`database`	`database` or `redis`
Cron	1 cron line (every minute)	Same (or Supervisor + `queue:work`)
PHP timezone tables	Up-to-date `php-tzdata`	Same

Not required: Redis, Node.js, npm, Composer (vendor/ is bundled in the download ZIP), or any long-running daemon on shared hosting.

What is included in the download

Full Laravel application source with vendor/ bundled — no Composer step needed on your server.
Migrations that create every table automatically on first install.
The Diagnostics page that checks every config knob and tells you what to fix.

White-label and branding

Everything customer-facing is driven by APP_NAME and per-tenant settings.

What	Where to change
Admin panel + email app name	Admin → Settings → Branding ("App name") — falls back to `APP_NAME` in `.env` until set
Admin panel logo / favicon	Admin → Settings → Branding — upload an image directly (square PNG/SVG, min 200 × 200 px)
SMTP relay (host, port, credentials, from address)	Admin → Settings → Email — overrides the `.env` `MAIL_*` values at runtime, with a "Send test email" button. Password is encrypted and never redisplayed
SaaS billing (Stripe, PayPal, Razorpay, offline)	Admin → Settings → Billing providers — overrides the `.env` `BILLING_*` / Cashier keys at runtime. Secrets are encrypted and never redisplayed. `.env` remains the fallback
Per-tenant email sender name	Admin → Settings → Branding (Operator default) or the tenant overrides it in `/app` → Settings → Business Profile
Public booking page title	Tenant controls in `/app` → Settings → Business Profile
Public page brand colour	Tenant controls in `/app` → Settings → Business Profile
Tenant sub-brand logo	Tenant uploads in `/app` → Settings → Business Profile — shown on the public booking page, falls back to the operator logo

White-label customer surfaces. People who book appointments see the tenant's business name on the public booking page and in notification emails. Your Operator brand (default Calbok via APP_NAME, overridable in Admin → Settings → Branding) appears on the marketing site, installer, /admin, and the optional "powered by" footer until you rebrand or hide that mark per plan.

Rate limiter IP resolution (`CLIENT_IP_MODE`)

The booking-rate and public-API limiters key on the visitor's real IP address. The correct mode depends on your hosting topology.

Mode	When to use	`.env` value
`direct`	Shared hosting / VPS where PHP sees the real visitor IP as `REMOTE_ADDR` (no reverse proxy)	`CLIENT_IP_MODE=direct`
`cloudflare`	Behind Cloudflare (orange-cloud proxying)	`CLIENT_IP_MODE=cloudflare`
`forwarded_for`	Behind Nginx/ALB that passes `X-Forwarded-For`	`CLIENT_IP_MODE=forwarded_for`
`forwarded`	Behind a proxy that passes RFC 7239 `Forwarded`	`CLIENT_IP_MODE=forwarded`

Never use CLIENT_IP_MODE=direct behind a reverse proxy. All visitors will share the proxy's internal IP and the rate limiter will be useless.

The Diagnostics → Client-IP resolution probe checks this and warns if it looks wrong.

Operator admin panel

Navigate to https://your-domain.com/admin (a hostname listed in CENTRAL_DOMAINS).

Menu item	What you do here
Dashboard	Platform KPIs and items that need your attention
Businesses	Create, suspend, or delete business accounts; Open as business for support; pending signups on the Pending approval tab
Plans	Define subscription plans (feature flags, seat limits, price)
Settings	One tabbed page: branding, website, email, sign-up, subscription billing, notification templates, integrations, licence
System → Health	Health probes (see Diagnostics)
System → Updates & backups	Backup checkpoint and apply migrations
System → Audit log	Audit trail of operator actions
Team	Operator admin accounts

Creating a tenant

Go to Admin → Businesses → New business.
Enter the business name, subdomain (or custom domain), the owner's email, and plan.
When an owner email is provided, the tenant receives an onboarding email with a link to set a password and complete their profile (business basics, first location + timezone, first service, and working hours).

Open as business (support and setup)

Day-to-day work for a specific business (calendar, catalog, customers, KPIs, reviews) happens in that business's /app panel, not in /admin.

To support or configure a business as the operator:

Go to Admin → Businesses, open the row menu (⋯), and choose Open as business.
You land on their /app dashboard with a banner showing which business you are viewing. Stop returns you to /admin.
START and STOP are written to the audit log.

Business staff use /app directly with their own login. See Business staff guides.

Resetting the demo tenant (`demo:reset`)

The demo seeder ships a realistic single-tenant demo with providers, services, past + future appointments, a group session, a recurring series, completed/no-show /cancelled mixes, and payment records — so every KPI widget has data.

Demo credentials

Role	Email	Password	Panel	Set by
Operator (super-admin)	the email/password you chose at installer Step 3	your choice	`/admin`	You, during the web installer (Step 3 — Your account). There is no fixed operator login after a normal web install.
Tenant staff (Tenant-admin)	`[email protected]`	`password`	`/app`	The demo seeder (installer optional checkbox, or `php artisan demo:reset` when demo mode is on)
Tenant staff (Front desk)	`[email protected]`	`password`	`/app`	The demo seeder (installer optional checkbox, or `php artisan demo:reset` when demo mode is on)

Only the demo tenant's staff login is a fixed, documented credential — it exists only if you opted into demo data. Your own Operator login is whatever you entered at Step 3; there is no [email protected] account on a web-installed site. ([email protected] / password is a local-development convenience seeded by php artisan db:seed on a git clone — it is not part of a buyer's web install.) demo:reset preserves the demo staff login — only transactional appointment data is wiped.

Resetting to a clean dataset

demo:reset runs only when DEMO_MODE=true in .env (a deliberate guard against accidental data loss on production installs). On a live demo server it also deletes businesses created through public signup so the Operator console stays tidy — not just appointment rows inside the demo tenant.

php artisan demo:reset

This command:

Refuses to run unless DEMO_MODE=true.
Deletes visitor sign-up businesses (everything except the canonical demo tenant).
Deletes transactional data (appointments, payments, notifications, reviews) only for the demo tenant.
Re-seeds the demo tenant with fresh realistic data.
Leaves the demo tenant's configuration (providers, services, hours) intact.

Use this before a sales demo or screen recording to ensure a fresh, coherent dataset. The command is tenant-scoped and cannot affect production tenants.

License activation and renewal

Envato issues your CodeCanyon purchase code and records its Regular or Extended licence type. Calbok does not issue a second purchase key. Enter the Envato code during the web installer (step 5, Activate). The purchase code is validated through Calbok's licence server against Envato, and the resulting signed token is stored encrypted in app_settings. The app verifies the cached token on each boot via LICENSE_SERVER_URL=https://license.calbok.com.

Renewal: not applicable — Calbok is a one-time purchase with optional extended support from CodeCanyon.
Transfer: to move the license to a new domain, deactivate from the old domain (Admin → Settings → License) with your purchase code, then activate on the new domain. If the old installation is unavailable, contact support with your purchase code to release it.
Offline installs: contact support if your server cannot reach the license server.

Security notes

Keep APP_DEBUG=false in production. Debug mode exposes stack traces and config.
Keep APP_ENV=production. Development mode disables several security headers.
The .env file must not be web-accessible. The web installer verifies this.
Never commit .env to version control.
The Diagnostics page is only accessible to super-admin users.