66toolkit documentation

✍️ New blog post: Keep MaxMind IP databases updated automatically on Ubuntu servers.
✍️ Blog post: Improve MaxMind IP to location lookups by 80x on Ubuntu servers.

Get started

This page describes the installation & update process of 66toolkit, as well as technical features.

Most features inside 66toolkit are self-explanatory and have helper texts near them.

Installation steps are straight-forward, minimum web related knowledge is required.

Support is exclusively handled through email. Ensure to attach proof of purchase when requesting support.

Requirements

Ensure your server meets the specified requirements prior to installation or purchase.

These requirements assume you're running on a decent, up-to-date server with the essential extensions already in place.

PHP PHP 8.4 - 8.5
Extensions cURL, OpenSSL, mbstring, MySQLi
Database MySQL 5.7.3+ or MariaDB equivalent
Server Apache or Nginx

Installation Services

We offer fast & reliable installation services at an affordable price.

Software installation - $35

  • Uploading the product files on your server (requires a fully configured and ready to go server).
  • Creating and configuring the database that is going to be used.
  • Full installation of the product.
You must own a server with a control panel like Plesk, cPanel, etc.

Server configuration & software installation - $69

  • Setting up a new server (Ubuntu OS) on one of those platforms: Hetzner, Cloudways, Vultr, DigitalOcean
  • Setting up the domain for the server
  • Free SSL Certificate Installation (Let's Encrypt)
  • Installation of Apache, MySQL with MySQLi, PHP
  • Installation and configuration of PHP's necessary modules / extensions
  • Full installation of the product

Product Update - $30

  • Backup of the files & database (upon request).
  • Update of the product to the latest version (no matter which version you are currently on).
  • Update of all the plugins you own (if any).
You are responsible for reintegrating any custom modifications to the original product files after an update.
Get in touch via email

Installation

The installation takes approximately 10 minutes.

Prepare the database

  1. Create a new database user (optional).
  2. Create a new database.
  3. Keep the database Host, Name, Username and Password available for the installation.

Upload the product

  1. Upload the contents of the product/ folder to your web host.
  2. Install it on a domain, subdomain or subfolder, depending on your needs.
  3. Apache: Ensure the .htaccess file is uploaded. It may be hidden on your computer.
  4. Nginx: Complete the Nginx setup after installation.

Run the installation

  1. Open domain.com/install in your browser.
  2. Set the required file and folder permissions to 755, 775 or 777, depending on your server configuration.
  3. Follow the installation steps.
  4. After a successful installation, your admin login credentials will be displayed.

Set up cron jobs

Cron jobs are required for background tasks.

  1. Go to Admin Panel → Settings → Cron.
  2. Create a cron job for each command displayed there.
  3. If needed, refer to your hosting provider's documentation for instructions on creating cron jobs.

Set up email

Configure SMTP if you want the site to send emails.

  1. Go to Admin Panel → Settings → SMTP (Email).
  2. Enter your SMTP provider credentials.
  3. Save the settings and send a test email.

Update

Follow these steps to update your current installation to the latest version.

Before updating, review the latest changes in the changelog and demo.

Create a backup

Back up your installation before starting the update.

  1. Back up your database.
  2. Back up your product files.

Update the files

  1. Download and extract the latest version of the product.
  2. Open the product/ folder and upload its contents over your existing installation.
  3. Do not overwrite the config.php file.

Update the database

  1. Open domain.com/update in your browser.
  2. Follow the update steps.
  3. After the update is complete, delete the update/ folder from your server.

Update plugins

  1. Go to Admin Panel → Plugins and update any plugins with newer versions available.
  2. If you use the Offload plugin, also replace the assets in your offloaded storage with the latest files from the themes/assets/ folder.

Caching

Caching is used throughout the application to reduce database load and improve response times.

By default, caching is enabled and uses the file system to store selected database query results.

Caching can be disabled if needed (not recommended) by opening index.php and setting the CACHE constant to 0. This disables caching across the entire application.

To change the cache driver, edit config.php and set the CACHE_DRIVER constant to files, apcu, or redis.

You can switch caching from the file system to Redis if your host supports it.

To enable Redis, edit config.php, configure your Redis connection settings, and set the REDIS_IS_ENABLED constant to 1.

Recommendation: Redis > APCu > File system > No caching. Use Redis when available and memory allows; otherwise, use APCu or the default file system caching.

NGINX Setup

Use the following NGINX rewrite rule to ensure proper functionality of the URLs:

if (!-e $request_filename) {
    rewrite ^\/(.+)$ /index.php?altum=$1 last;
}

This command should be added in your domain.conf nginx file in the location / { ... } field.

Docker

Docker is optional and intended for users who prefer container-based deployment instead of the standard shared hosting or VPS installation.

Requirements

Make sure Docker and Docker Compose are installed and running on your system.

Start the application

  1. The Dockerfile and docker-compose.yml files are included in the root folder of the product.
  2. Open a terminal and navigate to the product folder.
  3. Start the Docker containers: 
    docker compose up -d
  4. Open http://localhost/install in your browser and follow the installation process.

Database configuration

Use the following database credentials during installation:

  • Host: db
  • Port: 3306
  • Username: root
  • Password: root
  • Database: app

SSL configuration

SSL should be configured at the server level using a reverse proxy in front of the Docker container.

Social Logins

Follow these updated steps to set up additional login methods via popular social networks. Make sure to use HTTPS for all redirect URIs and verify your domains when required.

Facebook Login

  1. Go to the Meta for Developers page and log in.
  2. From the top-right menu, click My Apps → Create App and select the app type (usually Consumer).
  3. Fill out the required details (app name, contact email, business account) and click Create App.
  4. On your app dashboard, under Add Product, select Facebook Login and click Set Up.
  5. Go to Settings → Basic and complete required fields:
    • App Domains
    • Privacy Policy URL
    • Terms of Service URL
    • App Icon (recommended)
    Your domain must be verified if requested.
  6. Go to Facebook Login → Settings and:
    • Enable Client OAuth Login and Web OAuth Login.
    • In Valid OAuth Redirect URIs, add:
      https://yourdomain.com/login/facebook
  7. Switch the app from Development mode to Live so that non-admin users can log in.
  8. Go to Settings → Basic and copy your App ID and App Secret.
  9. In your Admin Panel → Settings → Facebook Login Tab, paste the keys, enable Facebook Login, and Submit.

Google Login

  1. Go to the Google Cloud Console and log in.
  2. Create a New Project or select an existing one.
  3. Navigate to APIs & Services → OAuth consent screen:
    • Choose External user type for public access.
    • Fill in app name, support email, app logo, privacy policy URL, and terms of service URL.
    • Add your domain under Authorized domains (must be verified).
  4. Add required scopes: openid, email, profile.
  5. Save and publish the consent screen.
  6. Go to Credentials → Create Credentials → OAuth Client ID:
    • Application type: Web Application.
    • In Authorized redirect URIs, add:
      https://yourdomain.com/login/google
  7. Copy the generated Client ID and Client Secret.
  8. In your Admin Panel → Settings → Google Login Tab, paste the keys, enable Google Login, and Submit.

Twitter (X) Login

  1. Go to the Twitter Developer Portal and log in.
  2. Apply for a developer account if you don’t have one.
  3. From the dashboard, go to Projects & Apps → Overview and click Create App.
  4. Fill out the app details and save.
  5. In App Settings → Authentication Settings:
    • Enable Web App, Automated App or Bot Type of App.
    • Enable Request email addresses from users.
    • In Callback URLs, add:
      https://yourdomain.com/login/twitter
    • In Website URL, add:
      https://yourdomain.com/
  6. Go to Keys and Tokens to copy the API Key and API Secret.
  7. In your Admin Panel → Settings → Twitter Login Tab, paste the keys, enable Twitter Login, and Submit.
  8. If required, request Elevated Access for your Twitter API project.

Discord Login

  1. Go to the Discord Developer Portal and log in.
  2. Click New Application and fill in the app details.
  3. Go to the OAuth2 page from the sidebar.
  4. In the Redirects section, add:
    https://yourdomain.com/login/discord
  5. Copy the Client ID and Client Secret from the Client information section.
  6. In your Admin Panel → Settings → Discord Login Tab, paste the keys, enable Discord Login, and Submit.

LinkedIn Login

  1. Go to the LinkedIn Developer Portal and log in.
  2. Click Create App and complete the details.
  3. On the app dashboard, go to Products and request access for Sign In with LinkedIn.
  4. Navigate to Auth → OAuth 2.0 Settings and add the redirect URL:
    https://yourdomain.com/login/linkedin
  5. Copy the Client ID and Client Secret.
  6. In your Admin Panel → Settings → LinkedIn Login Tab, paste the keys, enable LinkedIn Login, and Submit.

Microsoft Login

  1. Go to the Microsoft Azure Portal and log in.
  2. Navigate to Azure Active Directory → App Registrations → New Registration.
  3. Fill in these details:
    • App Name
    • Supported account types: Accounts in any organizational directory and personal Microsoft accounts
    • Redirect URI → Web: https://yourdomain.com/login/microsoft
  4. Click Register to create the app.
  5. Copy the Application (Client) ID for later use.
  6. Go to Certificates & Secrets → New client secret → copy the Value immediately.
  7. Go to Authentication and:
    • Check Access tokens (used for implicit flow).
    • Save changes.
  8. In your Admin Panel → Settings → Microsoft Login Tab, paste the Application ID and Secret Value, enable Microsoft Login, and Submit.

Apple Login

  1. Go to the Apple Developer portal and log in.
  2. Under Certificates, Identifiers & Profiles → Identifiers, create or select an App ID, enable Sign in with Apple, and configure it as the primary App ID.
  3. Create a new Services ID. Use a unique reverse-domain identifier, such as com.yourdomain.web. This Services ID is the Client ID that you will enter in the Admin Panel.
  4. Select the newly created Services ID, enable Sign in with Apple, and click Configure:
    • Select the primary App ID created in the previous step.
    • Under Domains and Subdomains, add your domain without the protocol, for example: yourdomain.com.
    • Under Return URLs, add:
      https://yourdomain.com/login/apple
    Save the configuration.
  5. Go to Keys, create a new private key, enable Sign in with Apple, and associate it with the same primary App ID.
  6. Register the key and download the .p8 private key file. Apple only allows this file to be downloaded once, so store it securely.
  7. Copy the Key ID shown for the newly created key and your Team ID from your Apple Developer membership details.
  8. Open the downloaded .p8 file with a text editor and copy its full contents, including the BEGIN PRIVATE KEY and END PRIVATE KEY lines.
  9. In your Admin Panel → Settings → Apple Login Tab, enter:
    • Client ID – the Services ID identifier.
    • Team ID – your Apple Developer Team ID.
    • Key ID – the identifier of the downloaded private key.
    • Private Key – the complete contents of the .p8 file.
    Enable Apple Login and Submit.

If you send emails to users who choose Apple’s private relay address, configure Apple’s email relay service for your sending domain as well. See Apple’s private email relay documentation.

GitHub Login

  1. Log in to GitHub, open Settings → Developer settings → OAuth Apps, and click New OAuth App or Register a new application.
  2. Enter an Application name and set the Homepage URL to your full website URL, for example: https://yourdomain.com/.
  3. In Authorization callback URL, add:
    https://yourdomain.com/login/github
  4. Click Register application.
  5. Copy the generated Client ID, then click Generate a new client secret and copy the generated Client Secret.
  6. In your Admin Panel → Settings → GitHub Login Tab, paste the Client ID and Client Secret, enable GitHub Login, and Submit.

Captchas

These are the steps to integrate more advanced and powerful captcha codes for your system.

Cloudflare Turnstile

  1. In your Admin Panel → Settings → Captcha page, set the captcha type to Cloudflare Turnstile.
  2. Log in to your Cloudflare Dashboard.
  3. In the sidebar, go to Turnstile and click Add Widget.
  4. Fill in the form:
    • Widget Name – a descriptive name (e.g., "Website Login").
    • Domain – your actual website domain (e.g., yourdomain.com).
    • Widget Mode – choose Managed for the simplest setup.
  5. Click Create to generate the widget.
  6. Cloudflare will now provide a Site Key and Secret Key.
  7. Go back to your Admin Panel and paste these keys into the fields under the Captcha settings.
  8. Click Save to apply the new settings.

Google reCAPTCHA

  1. In your Admin Panel → Settings → Captcha page, set the captcha type to Google reCAPTCHA v2 Checkbox.
  2. Log in to the Google reCAPTCHA Admin Console.
  3. Register a new site:
    • Label – a name for your site.
    • Select reCAPTCHA v2.
    • Add your website domain.
  4. Once created, copy the Site Key and Secret Key.
  5. Paste these keys into the corresponding fields in your Admin Panel.
  6. Click Save to enable Google reCAPTCHA on your site.

hCaptcha

  1. In your Admin Panel → Settings → Captcha page, set the captcha type to hCaptcha.
  2. Go to the hCaptcha Website and log in or create an account.
  3. Navigate to Sites → Add New Site.
  4. Fill out the required details:
    • Site Name
    • Domains – your actual website domain.
  5. After saving, hCaptcha will generate a Site Key.
  6. Go to Settings → Account and copy your Secret Key.
  7. Paste both the Site Key and Secret Key into the corresponding fields in your Admin Panel.
  8. Click Save to activate hCaptcha on your site.

Payment Processors

Follow these steps to connect your system with available payment gateways. Only available for Extended License holders.

PayPal

  1. Go to the PayPal Developer Dashboard and log in.
  2. Go to My Apps & Credentials → REST API Apps and click Create App.
  3. Enter an app name and other required details, then create it.
  4. Switch the app to Live Mode using the toggle near the app name.
  5. Copy the Client ID and Secret.
  6. In your Admin Panel → Settings → Processors → PayPal page, paste the Client ID and Secret. Set the Mode to Live and Submit the settings.
  7. Back in PayPal Dashboard, open the created app and go to the Webhooks section.
  8. Click Add Webhook and set the URL:
    https://yourdomain.com/webhook-paypal
  9. Select the events:
    • Payment sale completed
    • Checkout order approved
  10. Save the webhook.

Stripe

  1. Log in to the Stripe Dashboard.
  2. Go to Developers → API Keys.
  3. Ensure your keys are set to Live Mode to accept real payments.
  4. Copy the Publishable Key and Secret Key.
  5. In your Admin Panel → Settings → Processors → Stripe page, paste the keys and save.
  6. From the Stripe sidebar, go to Developers → Webhooks and click Add Endpoint.
  7. Set the Endpoint URL:
    https://yourdomain.com/webhook-stripe
  8. Select events to send:
    • checkout.session.completed
    • invoice.paid
    • invoice.upcoming
  9. Save the webhook and copy the Signing Secret.
  10. In your Admin Panel, paste the Signing Secret into the Webhook Secret field under the Stripe tab.

Offline Payments

  1. Enable offline payments in your Admin Panel → Settings → Processors → Offline payment page.
  2. In the Instructions field, add clear details about how customers should complete offline payments (e.g., bank account details).
  3. When customers check out, they can select offline payment as a method.
  4. They will see the instructions and must upload proof of payment.
  5. As an admin, go to Admin Panel → Payments, review proofs, and approve valid payments.
  6. Upon approval, the plan is activated for the customer.
  7. If proof is invalid or fake, delete the payment to reject it.

Coinbase Commerce

  1. Log in to the Coinbase Dashboard.
  2. Go to Settings.
  3. Under API Keys, generate and copy your API Key.
  4. In your Admin Panel → Settings → Processors → Coinbase page, paste the API Key.
  5. Under Webhook Subscriptions, click Add Endpoint and enter:
    https://yourdomain.com/webhook-coinbase
  6. Save the webhook and copy the Shared Secret.
  7. In your Admin Panel, paste the Shared Secret into the Webhook Secret field under the Coinbase tab.

Crypto.com

  1. Log in to the Crypto.com Merchant Dashboard.
  2. Go to Developers → API Keys.
  3. Copy your Publishable Key and Secret Key.
  4. In your Admin Panel → Settings → Processors → Crypto.com page, paste the keys.
  5. Go to Webhooks in the Crypto.com dashboard and click Add Webhook.
  6. Set the URL:
    https://yourdomain.com/webhook-crypto-com
  7. Copy the Signature Secret and paste it into the Webhook Secret field in your Admin Panel.

PayU

  1. Log in to your PayU account.
  2. Create a new shop and fill in all required details.
  3. In your Admin Panel → Settings → Processors → PayU page, paste the provided API keys.

Iyzico

  1. Log in to the Iyzico Merchant Dashboard.
  2. Go to Merchant Settings.
  3. Copy your API Key and Secret Key.
  4. In your Admin Panel → Settings → Processors → Iyzico page, paste the keys.
  5. Scroll to the Merchant Notifications section and add:
    https://yourdomain.com/webhook-iyzico
  6. Save the configuration.

Paystack

  1. Log in to your Paystack Dashboard.
  2. Go to Settings → API Keys & Webhooks.
  3. In your Admin Panel → Settings → Processors → Paystack page, paste the API keys.
  4. In Paystack, set your Webhook URL to:
    https://yourdomain.com/webhook-paystack
  5. Save changes.

Razorpay

  1. Log in to your Razorpay Dashboard.
  2. Go to Settings → API Keys and generate keys.
  3. In your Admin Panel → Settings → Processors → Razorpay page, paste the keys.
  4. Go to Settings → Webhooks and click Add New Webhook.
  5. Set the Webhook URL:
    https://yourdomain.com/webhook-razorpay
  6. Create a new Webhook Secret (like a password).
  7. Enable these events:
    • subscription.charged
    • payment_link.paid
  8. Save the webhook, then paste the secret into the Razorpay tab in your Admin Panel.

Mollie

  1. Log in to your Mollie Dashboard.
  2. Go to Developers → API Keys and copy your Live API Key.
  3. In your Admin Panel → Settings → Processors → Mollie page, paste the key.
  4. Activate allowed payment methods in your Mollie account.

Yookassa

  1. Log in to your Yookassa Dashboard.
  2. Go to Developers → API Keys and generate keys.
  3. In your Admin Panel → Settings → Processors → Yookassa page, paste the keys.
  4. Go to Integration → HTTP Notifications and add:
    https://yourdomain.com/webhook-yookassa
  5. Ensure receipts/invoices are enabled for compliance.

Paddle Classic

  1. Log in to the Paddle Vendors Dashboard.
  2. Go to Developer Tools → Authentication and copy your Vendor ID and API Key.
  3. In your Admin Panel → Settings → Processors → Paddle page, paste the Vendor ID and API Key.
  4. Go to Developer Tools → Public Key and copy it into the Public Key field in your Admin Panel.

Paddle Billing

  1. Log in to your Paddle Billing Dashboard.
  2. Go to Developer Tools → Authentication:
    • Under the API Keys tab, click New API Key.
    • Enable All permissions for Write.
    • Copy the generated API Key.
    • In your Admin Panel → Settings → Processors → Paddle Billing page, paste the key and save.
  3. Still under Authentication:
    • Go to the Client-side Tokens tab.
    • Click New Client-side Token and copy the Token.
    • In your Admin Panel → Settings → Payment Processors → Paddle, paste the token and save.
  4. Next, go to Developer Tools → Notifications:
    • Click New Destination.
    • In the URL field, enter your webhook endpoint:
      https://yourdomain.com/webhook-paddle
    • In the Events section, select only:
      • subscription.created
      • subscription.updated
      • transaction.paid
    • Save the destination, then click Edit and copy the Secret Key.
    • In your Admin Panel → Settings → Payment Processors → Paddle, paste the Secret Key and save.
  5. Finally, go to Checkout → Checkout Settings and set your website URL in the Default Payment Link field.

Midtrans

  1. Log in to the Midtrans Dashboard.
  2. Go to Settings → Access Keys and copy your Server Key.
  3. In your Admin Panel → Settings → Processors → Midtrans page, paste the Server Key.

Flutterwave

  1. Log in to the Flutterwave Dashboard.
  2. Go to Settings → API Keys and copy your Secret Key.
  3. In your Admin Panel → Settings → Processors → Flutterwave page, paste the Secret Key.
  4. Go to the Flutterwave Webhooks page and add:
    https://yourdomain.com/webhook-flutterwave

LemonSqueezy

  1. Log in to LemonSqueezy.
  2. Create a product in LemonSqueezy.
  3. Create variants for:
    • One-time Payments (Monthly, Quarterly, Biannual, Annual, Lifetime)
    • Recurring Payments (Monthly, Annual)
  4. Go to Settings → API Keys and generate an API key.
  5. In your Admin Panel → Settings → Processors → LemonSqueezy page, paste:
    • API Key
    • Store ID (found in store settings)
    • Each Variant ID for your products
  6. Go to Settings → Webhooks and create a webhook with URL:
    https://yourdomain.com/webhook-lemonsqueezy
  7. Select events:
    • order_created
    • subscription_payment_success
  8. Copy the Signing Secret and paste it into the LemonSqueezy tab in your Admin Panel.

Klarna

  1. Log in to the Klarna Portal or Klarna Playground Portal (development).
  2. Go to Settings → Klarna API Keys page.
  3. Generate your new Klarna API key & make sure to copy both the Username and Password.
  4. In your Admin Panel → Settings → Processors → Klarna page, paste the keys and save.

Plisio

  1. Log in to your Plisio Dashboard.
  2. Ensure your domain is connected and your crypto wallets are properly configured.
  3. Navigate to the API page, then click on the Site Settings button for your connected domain.
  4. Copy the generated Secret Key and paste it into your Admin Panel → Settings → Processors → Plisio page.
  5. Specify the list of cryptocurrencies you wish to accept, choose your default currency, and save the settings.

1pay

  1. Log in to your 1pay account.
  2. Find your checkout instance name. If your checkout domain is yourname.1pay.ch, use only yourname.
  3. Go to the API settings page and copy your API Key.
  4. In your Admin Panel → Settings → Processors → 1pay page, enable 1pay payments, paste the instance name and API key.
  5. Select the currencies that you want to accept through 1pay.
  6. Create a new webhook in your 1pay account and set the webhook URL to:
    https://yourdomain.com/webhook-onepay
  7. Make sure the webhook sends JSON requests.
  8. Copy the Webhook Signing Key and paste it into your Admin Panel → Settings → Processors → 1pay page.
  9. Optionally add a Look&Feel Profile ID if you want to use a custom 1pay checkout design.
  10. Optionally add a Subscription Cancellation Interval if you want to use a custom cancellation period for recurring payments. Use the PHP interval format, such as P1M for one month.
  11. Save the settings and make a test payment to confirm the integration works properly.

Revolut

  1. Log in to your Revolut Business dashboard.
  2. Navigate to the Settings page, then click on the APIs sidebar link, then in the Merchant API section.
  3. Copy the generated API secret Key, paste it into your Admin Panel → Settings → Processors → Revolut page, and save the settings.

Taxes & Billing

Use the Taxes & Billing system to collect billing information and apply taxes to paid plans.

Enable taxes & billing

  1. Go to Admin Panel → Settings → Payment.
  2. Enable the Taxes & Billing system.

Create a tax

  1. Go to Admin Panel → Taxes.
  2. Select Create Tax.
  3. Configure the tax according to your requirements and save it.

Assign a tax to a plan

  1. Go to Admin Panel → Plans.
  2. Select the paid plan you want to configure.
  3. Assign the desired tax and save the plan.

Multicurrency

Multicurrency allows users to choose from the currencies you make available.

Enable multicurrency

Go to Admin Panel → Settings → Payment and configure the currencies you want to support.

Configure plan prices

Go to Admin Panel → Plans, select a plan and set its price for each supported currency.

Configure payment processors

Go to Admin Panel → Settings and enable or disable currencies individually for each payment processor.

Configure exchange rates

For automatic currency conversion, obtain an API key from FreeCurrencyAPI.com and add it under Admin Panel → Settings → Payment.

The API key is optional, but recommended. It converts transactions to your default currency so administrative statistics remain consistent across multiple currencies.

Webhook verification

Each webhook which comes from the Admin panel → Settings → Webhooks page, includes a unique ID, a timestamp, and a signature in each request. These values are sent as HTTP headers and are required for verification.

On your endpoint, you must read the raw request body, rebuild the signed payload, and verify the signature using your webhook secret key.

The signed payload is created in the following order:

webhook_id.webhook_timestamp.raw_body

The signature is generated using HMAC SHA-256, base64-encoded, and sent in the Webhook-Signature header with a v1, prefix.

You must also validate the timestamp and reject requests outside a 5-minute window to prevent replay attacks.

Use the following PHP example to verify incoming webhooks: 

/* Get webhook related headers */
$webhook_id = $_SERVER['HTTP_WEBHOOK_ID'] ?? null;
$webhook_timestamp = $_SERVER['HTTP_WEBHOOK_TIMESTAMP'] ?? null;
$webhook_signature = $_SERVER['HTTP_WEBHOOK_SIGNATURE'] ?? null;

if (!$webhook_id || !$webhook_timestamp || !$webhook_signature) {
    http_response_code(400);
    die();
}

/* 5 minute tolerance replay window */
if (abs(time() - (int) $webhook_timestamp) > 300) {
    http_response_code(400);
    die();
}

/* Get raw posted body of the request */
$raw_body = file_get_contents('php://input');

/* Start regenerating the signature */
$signed_payload = $webhook_id . '.' . $webhook_timestamp . '.' . $raw_body;

/* Webhook secret key from the admin panel */
$secret_key = settings()→webhooks→secret_key;

/* Strip the version from the webhook signature */
$signature_key = substr($webhook_signature, strlen('v1,'));

/* Generate expected signature to compare */
$expected_signature = base64_encode(
    hash_hmac('sha256', $signed_payload, $secret_key, true)
);

/* Compare the signatures */
if (!hash_equals($expected_signature, $signature_key)) {
    http_response_code(401);
    die();
}

/* Continue with your own processing */

OpenAI integration

Connect your system to the OpenAI API to enable AI-powered features such as AI translation.

Create an API key

  1. Log in to the OpenAI API Platform.
  2. Open the API Keys page for the project you want to use.
  3. Create a new secret key and optionally give it a descriptive name, such as Production Website.
  4. Copy and securely store the generated API key. The full secret key is only displayed when it is created.

Configure 66biolinks

  1. Go to Admin Panel → Settings → Main → Other settings.
  2. Paste the API key into the OpenAI API key field.
  3. Save the settings.

API billing

OpenAI API usage is billed separately from ChatGPT subscriptions. Configure API billing in your OpenAI API Platform account if required.

Google Safe Browsing

The Safe Browsing integration will automatically check all url's that are submitted by your users with Google to see if they are malware, spam or any other threats.

  1. Go to Google Developers Console page and make sure you are logged in.
  2. Now you need to create a new project.
  3. Now you need to search for the SafeBrowsing API in the API Library and make sure to enable it.
  4. Go to the Credentials page by clicking on the link in the sidebar.
  5. Click on the Create Credentials button and select API Key
  6. Copy your freshly created API Key
  7. Go to your Product's Admin Panel -> Settings -> Links and enter the Google Safe Browsing API Key that you copied.

AIX plugin

This is the installation documentation for the AIX plugin.

  1. Download the product files from Codecanyon after purchasing & unzip them.
  2. Upload the aix folder to your 66toolkit installation, plugins folder.
  3. Go to your installation website → Admin panel → Plugins → Find the AIX plugin and enable it.

This is the documentation for the OpenAI API. It is used to provide the Documents, Images, Speech to Text & Chat functionality.

  1. Go to OpenAI API Keys page and make sure you are logged in.
  2. Make sure to create a new secret key and copy the new key.
  3. Go to your Admin Panel -> Settings -> AIX and enter the OpenAI API Key that you copied.
  4. Make sure to enable and configure the system however you want from this page as well & save the new settings.
  5. You can now control the plan limitations the same as with all the plan settings, from the Admin panel → Plans section.

This is the documentation for the ClipDrop API. It is used to provide the Images (StableDiffusion) functionality.

  1. Go to ClipDrop API Keys page and make sure you are logged in.
  2. Make sure to reveal your API KEY and copy that.
  3. Go to your Admin Panel -> Settings -> AIX and enter the ClipDrop API Key that you copied.
  4. Make sure to save the new settings.
  5. You can now control the plan limitations the same as with all the plan settings, from the Admin panel → Plans section.

Hosting & Domains

Managed Cloud Hosting

Easy, intermediate

Shared Hosting

Easy

Self-managed VPS Hosting

Advanced

Domains

We recommend Cloudways for beginners or intermediates. We currently use Hetzner for hosting and Namecheap for domains for all AltumCode websites.

Frequently asked questions

Answers to common questions and troubleshooting issues.

This is usually caused by an incorrect server rewrite configuration.

Nginx: Make sure you completed the Nginx setup.

Apache:

  • Make sure the .htaccess file was uploaded.
  • Make sure the .htaccess file has the correct permissions, usually 644.
  • Make sure mod_rewrite is enabled on your server.
  • Restore the original .htaccess file if it was modified.

  • If your server uses .htaccess, try removing its first line. Some server configurations do not support it.
  • If the error occurs when submitting a form, your web host may be blocking the request. Try disabling mod_security or contact your hosting provider.

SMTP issues are usually caused by incorrect credentials, an unavailable SMTP server or your web host blocking the connection. Verify your SMTP settings first, then contact your SMTP or hosting provider if the issue persists.

The Bearer Authentication header is either not being sent correctly or your hosting provider is removing it before it reaches the application. Contact your hosting provider or, for Apache servers, try this authorization header fix.

This usually means part of the payment processor configuration is missing or incorrect. Review its setup and verify all required credentials, callbacks and settings.

Spam registrations cannot be completely eliminated, but the available protection features can significantly reduce them.

  • Email confirmation - Admin Panel → Settings → Users
  • Captcha - Admin Panel → Settings → Captcha
  • Country blocking - Admin Panel → Settings → Users
  • Email domain blocking - Admin Panel → Settings → Users
  • Automatically delete unconfirmed or old users - Admin Panel → Settings → Users
  • Bulk delete users - Admin Panel → Users
  • Email Shield plugin - adds blacklist and additional signup protection

  1. Open your product database using a database manager such as phpMyAdmin.
  2. Open the users table and find your admin account.
  3. Set its password to $2y$10$uFNO0pQKEHSFcus1zSFlveiPCB3EvG9ZlES7XKgJFTAl5JbRGFCWy. This temporarily sets the password to admin.
  4. Delete the folder inside uploads/cache/ to clear the cache.
  5. Log in and immediately change your password.

  1. Open your product database using a database manager such as phpMyAdmin.
  2. Open the settings table and find the captcha key.
  3. Edit its value and change "login_is_enabled":true to "login_is_enabled":false.
  4. Delete the folder inside uploads/cache/ to clear the cache.

Go to Admin Panel → Languages → {language name} → Translate app to change static website text.

It is recommended to create a new language instead of editing the original one, so your changes are not overwritten during future updates.

Advanced users can also edit the language files directly:

  • User side: app/languages/english#en.php
  • Admin side: app/languages/admin/english#en.php

Create a new language from Admin Panel → Languages → Create language, then use Translate app to translate its strings.

Advanced users can also duplicate the original language files and follow the same naming format: language_name#language_code.php.

Your server is limiting the number of form fields that can be submitted at once.

Increase the PHP max_input_vars setting to the value displayed under Admin Panel → Languages → {language name} → Translate app.

Contact your hosting provider if you cannot change this setting yourself.

  • Page structure and components: edit themes/altum/views/index/index.php.
  • Text: use the language system.
  • Images: go to Admin Panel → Settings → Custom images.
  • Custom landing page: go to Admin Panel → Settings and configure the Custom landing page URL.

Choose the method that best matches what you want to customize:

  • Theme colors: Admin Panel → Settings → Theme
  • Custom CSS: Admin Panel → Settings → Custom CSS
  • CSS files: edit the files in themes/altum/assets/css/
  • SCSS: edit and recompile the source files (advanced)

Support for custom design work is not included.

Go to Admin Panel → Resources, Pages to customize the footer branding.

  1. Back up your product files and database.
  2. Move both to the new server.
  3. Update the config.php file with the new server and database details.
  4. Verify that all configuration values are correct for the new hosting environment.