Configuration

Open Add-ons → Manage add-ons → Telegram & WhatsApp Order Notifications → Settings. The settings have five tabs: General, Telegram, WhatsApp, SMS and License. The test buttons on the channel tabs use the saved values, so save first. In CS-Cart Ultimate every storefront can have its own values (select the storefront at the top of the admin panel).

Credentials (bot token, access token, app secret, auth token, API key) are password fields: they are masked on the page, never written to the delivery log and never sent anywhere except to the provider they belong to.

General

Setting	Description
Send notifications	Switch off to pause all messages. Rules, the log and opt-ins are kept.
Channels	Shows which channels are set up and how many active rules use them, with links to the rules, the log and the opt-ins.
Send messages	Right away (recommended): a message is queued while the order is saved and sent in the background right after the page was answered (on PHP-FPM and LiteSpeed after the response is flushed; on other servers by a short background request to your own store). Checkout never waits for a provider. Cron only: messages wait for the cron job.
Cron job	The line to add to your server’s crontab (every 5 minutes is enough). It sends messages in “Cron only” mode, retries failed messages and deletes old log rows. Shows the last run.
Keep the delivery log (days)	Sent, failed and expired messages older than this are deleted once a day. Default 90.
Telegram chats of the staff	One chat ID per line: a person who pressed Start in your bot, a group the bot was added to (negative ID) or a channel where the bot is an admin (@channelname). Text after the ID (700100 - Store team) is a note. Use Find chats on the Telegram tab.
WhatsApp numbers of the staff	Comma-separated, international format (+15550100123).
SMS numbers of the staff	Comma-separated, international format.
Default country calling code	Digits only, for example 1 or 44. Used when a customer types a national number without +; the first 0 of a national number is dropped. Leave empty if your customers always enter international numbers.
Customer messages	Only customers who opted in (default): customers get WhatsApp/SMS messages only after ticking the checkbox at checkout or in their profile. All customers with a phone number: for stores that collect consent another way. An opt-out (checkbox, opt-out link, admin) is always respected.
Show the opt-in checkbox at checkout and in the profile	Shows “Send me order updates on WhatsApp or by SMS” next to the terms at checkout and in My account → Profile details.
Vendors can set up their own notifications	Multi-Vendor only. Vendors connect Telegram and enter their numbers in Orders → Message notifications.

Telegram

1. In Telegram, open @BotFather, send /newbot, choose a name and a user name ending in bot. BotFather answers with a token like 123456789:AA….
2. Paste the token into Bot token and save. Test connection shows the bot’s user name.
3. Every staff member opens the bot (t.me/<your bot>) and presses Start. For a group, add the bot to the group and send a message there. For a channel, add the bot as an administrator.
4. Click Find chats: the chats that wrote to the bot recently are listed; Add to staff chats puts them into the General tab. Save the settings.
5. Send a test message with Send test.

Telegram texts may use <b>, <i>, <u>, <s>, <code>, <pre> and <a href="…">. Variable values are escaped automatically.

WhatsApp (Cloud API)

Business-initiated WhatsApp messages must use a message template approved by Meta. Plain text only reaches people who wrote to your number in the last 24 hours, so customer rules use templates.

1. In Meta for Developers, create a Business app and add the WhatsApp product. Add your business phone number and verify it (a free test number works for testing, but only for the recipients you add in the app).

2. Create a System User in Meta Business Settings with the whatsapp_business_messaging permission and generate a permanent access token.

3. Enter the Phone number ID (WhatsApp Manager → API Setup; not the phone number itself) and the Access token, save, and click Test connection: it shows the number and its verified name.

4. Create templates in WhatsApp Manager → Message templates, category Utility, for example:

   Name	Body (example)	Parameters in the default rule
   order_confirmation	Hi {{1}}, thank you for your order #{{2}} ({{3}}). We will keep you posted here.	{customer_firstname}, {order_id}, {total}
   order_status_update	Hi {{1}}, your order #{{2}} is now: {{3}}.	{customer_firstname}, {order_id}, {status}
   order_shipped	Good news: your order #{{1}} has shipped with {{2}}. Tracking number: {{3}}.	{order_id}, {carrier}, {tracking_number}

   Enter the template names and languages exactly as approved in the rules (Usage).

5. Optional, for delivery reports (Delivered/Read in the log): in the Meta app, open WhatsApp → Configuration → Webhook, enter the Webhook URL shown on the tab and the Webhook verify token, and subscribe to the messages field. Enter the app’s App secret (App settings → Basic) so the add-on can verify the signature of every report. Meta only calls public HTTPS URLs.

6. Send a test with Send test. Meta’s hello_world template (en_US) works on every new number.

Setting	Description
Phone number ID	The ID of the sending number.
Access token	Permanent System User token (masked).
Graph API version	Default v23.0. Raise it when Meta retires the version.
App secret	Verifies the X-Hub-Signature-256 header of delivery reports (masked). Reports without a valid signature are refused.
Webhook verify token	Generated at installation; type the same text in the Meta app.

SMS

Choose the SMS gateway: None, Twilio or Other gateway (HTTP API).

Twilio: enter the Account SID (starts with AC), the Auth token and either a Sender (a Twilio number in international format, or an alphanumeric sender ID where your destination countries allow it) or a Messaging Service SID (starts with MG). Test connection reads your account. On public HTTPS stores every message carries a status callback, so the log shows Delivered or Undelivered; the add-on verifies Twilio’s signature on each callback.

Other gateway (HTTP API): most SMS providers offer a simple HTTP API. Describe it with these fields:

Setting	Description
Request URL	Endpoint. Placeholders in the URL are URL-encoded: {to} (+E.164), {to_digits} (without +), {text}, {from}, {api_key}.
Method	POST or GET.
Body format	JSON or form (x-www-form-urlencoded) for POST.
Request body	POST body with the same placeholders, for example {"to":"{to}","text":"{text}","sender":"{from}"}. Values are encoded for the format.
Extra headers	One Name: value per line, for example Authorization: Bearer {api_key}.
API key	Stored masked; insert it with {api_key}.
Sender	Value of {from}.
Success text	Optional. The answer must contain this text to count as sent (for example "status":"ok"); empty means any HTTP 2xx answer.

HTTP 5xx, 429 and network errors are retried; other answers count as failed and show the gateway’s answer in the log.

Privileges

Administrators need View order messaging to open the pages and Manage order messaging to change rules, send tests, retry messages and change opt-ins (Users → User groups → Privileges, section Orders). On Multi-Vendor, vendors only get the Message notifications page for their own settings.

License

The license status is shown in a License card at the top of the add-on page, above the tabs, so you see it on every tab. The License tab holds the key itself. The key is stored once for the whole installation.

The License card shows:

• the status in color: green when valid, blue for a development host or the 14-day period before a key is required (with the days left), amber when the license server could not be reached (with the days left) or a Marketplace number is still being verified, red when the add-on is switched off;
• in plain words what the status means and, when the add-on is (or will be) switched off, what stops: no Telegram, WhatsApp or SMS messages are sent and the opt-in checkbox is hidden at checkout; orders, checkout and the store e-mails keep working; rules, the delivery log and customer opt-ins are kept;
• the licensed domain, every storefront with its result (covered, development host, not covered), the end of the updates and support period, the last and the next check, and the key in use (masked);
• the actions Enter license key / Change license key (opens the License tab), Check now (verifies at once and stays on the page), Manage license (your licenses on cs-cart.kaviolabs.com) and, without a valid license, Buy a license.

In Add-ons → Manage add-ons the add-on’s row shows a small license badge next to its name, for example License: Valid or License: Pending · 9 days left.

The add-on’s own admin pages (delivery log, rules, rule editor, opt-ins) show the license status in a bar at the top: a small green chip when the license is valid, or a banner with the status, what is switched off and the same actions as the card. Vendors never see license information.

Setting	Description
License key	Your Kavio Labs license key (KAVIO-XXXX-XXXX-XXXX-XXXX, from My licenses on cs-cart.kaviolabs.com) or your CS-Cart Marketplace license number. If you entered the Marketplace license number in Add-ons → Manage add-ons (the add-on’s license field), leave this empty: the add-on uses that number.
License status	Points to the License card and explains what the check sends.

What the license covers. A license is bound to the base domain you entered at purchase (for example example.com) and covers every subdomain of it (www.example.com, shop.example.com, staging.example.com). Local development hosts are always allowed: localhost, 127.0.0.1 and other private IP addresses, and host names ending in .localhost, .test, .local, .example or .invalid. A store on a different base domain needs its own license. If you move your store to a new domain, contact support.

When the add-on checks. When you save the key, and then once a day. The check runs only in the admin panel (on a page you open) or from cron, never while customers browse the storefront or place orders, and takes a few seconds at most. A cron job keeps the license verified even when nobody opens the admin panel:

php /path/to/store/admin.php --dispatch=kv_order_notifications_messaging_license.check

What is sent. The check sends this to https://cs-cart.kaviolabs.com and nothing else: the license key, the add-on ID and version, the host names of your storefronts, your CS-Cart version and edition, and a random one-time value. No customer, vendor, order, message or personal data is sent. The server answers with a digitally signed result, so a forged answer is ignored.

Statuses.

Status (card)	Color	What happens
Valid	Green	The license is valid for this domain. Everything works.
Development host	Blue	The store runs on a local development host, which every license covers. Everything works.
Pending verification	Amber	A CS-Cart Marketplace license number was accepted, but the Marketplace has not confirmed it yet. Everything works.
Pending · N days left	Blue	No verified key yet (a new installation). Everything works for 14 days.
Grace period · N days left	Amber	The last checks failed (for example a network problem). The add-on keeps working for 14 days after the first failed check.
Not activated, Invalid key, Revoked, Domain mismatch, Not verified	Red	No new messages are queued or sent (messages already in the queue wait and expire after 48 hours), the opt-in checkbox is hidden and test sends are refused. Orders, checkout, status changes and the store e-mails keep working. Rules, the log, opt-ins and vendor settings are kept, and the opt-out link in earlier messages keeps working. Domain mismatch shows the licensed domain next to the domain your store runs on.

When your updates and support period ends, the add-on keeps working. Only updates and support stop.

License information appears in the admin panel only, and only for administrators who may manage add-ons; vendors and customers never see it. When the add-on is switched off, other admin pages also show a notice once per session with a link to the add-on page; the add-on page and the add-on’s own pages show the card or the status bar instead.