---
title: "Store service: shared-hosting bootstrap source"
description: "Store service: shared-hosting bootstrap source for the complete private reference application."
slug: "/docs/v1/guides/store-service/bootstrap"
section: "Webhooks and integrations"
order: 794
audience: "all"
level: "advanced"
last_updated: "2026-10-18"
version: "v1"
related: ["/docs/v1/guides/any-store", "/docs/v1/api/idempotency"]
draft: false
---
Use only in a dedicated backend document root with private sibling state. Follow the complete [installation layout](/docs/v1/guides/store-service#install-the-files). Do not overwrite your existing store's public index or publish environment.php.

## What you will learn

Read and run the exact Store service: shared-hosting bootstrap source with the complete shared application, without exposing private credentials or claiming an unverified payment.

## Public entry point

```php
<?php
declare(strict_types=1);
// Standalone dedicated-backend public entry; NOT a replacement for your store's index.
// Private archive root must be ../private/kdpika-store relative to this public directory.
// Only POST /provider-event; no setup UI, secret URL token, browser CLI or direct files.
ini_set('display_errors', '0');
if (($_SERVER['REQUEST_METHOD'] ?? '') !== 'POST' || ($_SERVER['REQUEST_URI'] ?? '') !== '/provider-event') {
    http_response_code(404); header('Content-Type: application/json'); echo '{"accepted":false}'; exit;
}
try {
    $root = realpath(__DIR__); $private = realpath(dirname(__DIR__) . '/private/kdpika-store');
    if ($root === false || $private === false || str_starts_with($private . '/', $root . '/')) { throw new RuntimeException('Private backend required'); }
    $environment = require $private . '/environment.php';
    if (!is_array($environment)) { throw new RuntimeException('Private configuration required'); }
    foreach ($environment as $name => $value) {
        if (!is_string($name) || !preg_match('/\AKDP_[A-Z0-9_]+\z/D', $name) || !is_string($value) || preg_match('/[\r\n\x00]/', $value)) { throw new RuntimeException('Invalid environment'); }
        putenv($name . '=' . $value);
    }
    require $private . '/stores/service.php';
} catch (Throwable) {
    http_response_code(503); header('Content-Type: application/json'); header('Cache-Control: no-store'); echo '{"accepted":false}';
}
```

## Apache route file

The complete stores/public/.htaccess file is included in the [source archive](/docs/downloads/store-integrations.zip); copy it only into this dedicated public directory. It disables directory listings and routes provider-event to index.php. For another web server configure the equivalent exact route; do not expose private source or state.

## Private CLI bootstrap

```php
<?php
declare(strict_types=1);
// Private shared-hosting CLI bootstrap; php stores/cron.php work | inspect | mail.
// Loads environment.php outside web root. Never invoke through an HTTP cron URL.
if (PHP_SAPI !== 'cli') { http_response_code(404); exit; }
try {
    if ($argc !== 2 || !in_array($argv[1], ['work', 'inspect', 'mail'], true)) { throw new RuntimeException('Choose work, inspect or mail'); }
    $environment = require dirname(__DIR__) . '/environment.php';
    if (!is_array($environment)) { throw new RuntimeException('Private environment required'); }
    foreach ($environment as $name => $value) {
        if (!is_string($name) || !preg_match('/\AKDP_[A-Z0-9_]+\z/D', $name) || !is_string($value) || preg_match('/[\r\n\x00]/', $value)) { throw new RuntimeException('Invalid environment'); }
        putenv($name . '=' . $value);
    }
    require __DIR__ . ($argv[1] === 'mail' ? '/mail.php' : '/service.php');
} catch (Throwable) { fwrite(STDERR, "Store configuration requires private review.\n"); exit(1); }
```

## Expected result

Only POST /provider-event invokes ingress; unknown routes return a safe refusal. The cron bootstrap requires PHP CLI and only accepts work, inspect or mail. It validates environment variable names/values and loads files outside the web root. Its safe error message is not permission to turn on display_errors publicly.


## Prerequisites

Complete the [private service installation](/docs/v1/guides/store-service). Keep all files from the exact source archive together, use PHP 8.2+ with its documented extensions and start with an isolated [Sandbox](/docs/v1/start/glossary#sandbox) [product](/docs/v1/start/glossary#product)/key. A source fragment alone is not the application.


## Common mistakes

Do not deploy one module without its archive dependencies, place configuration under the web root, skip provider API verification or clear a durable ledger to bypass review. Optional Node/Python ingress still requires the PHP worker.


## Security notes

Use least-privilege private provider and product-scoped licensing credentials, verified HTTPS, owner-only persistent state and separate secrets per account/environment. Never trust browser payment claims. Preserve held operations after an unknown result and reconcile before another write; exactly-once behavior across systems is not guaranteed.


## Troubleshooting

For a receipt refusal check raw-byte preservation, the matching endpoint secret/account/mode, server clock where applicable and the private bootstrap layout. For REVIEW/IN_FLIGHT inspect provider state, safe private error codes and the licensing ledger before retrying. Missing permissions, recipient data or an initial mapping are not successful payments. For mail verify the separate SMTP ledger and provider [delivery](/docs/v1/start/glossary#delivery) evidence. Do not post raw events, keys or SQLite files publicly.


## Next steps

Run the selected [provider Sandbox procedure](/docs/v1/guides/store-service#choose-your-provider), then test [private key email delivery](/docs/v1/guides/store-service/email). Review [supported recipe limitations](/docs/v1/guides/recipes) before enabling [Live](/docs/v1/start/glossary#live).


## Related

- [Generic store trust boundary](/docs/v1/guides/any-store)
- [API idempotency](/docs/v1/api/idempotency)
- [Private service setup](/docs/v1/guides/store-service)
- [Manual key delivery](/docs/v1/guides/manual-issuance)