Release notes

Keyright ships as a hosted issuing service plus SDKs for .NET, Node.js, Python and Java (and a raw HTTP API for every other language). The SDKs share one version line and verify the identical signed format, so a mixed-language product line upgrades together. Package versions: NuGet, npm, PyPI, Maven Central (com.delta1labs:keyright).

2.9.0

Released 2026-11-11.

• Community Edition — real licensing, free. After the fully-functional 3-day pre-trial, an unlicensed self-hosted instance now falls back to a free Community Edition instead of locking out: up to 100 active licenses and 1 product on a single node, with online activation and the admin dashboard (a “Powered by Keyright” footer). A paid self-license upgrades the same instance in place — no reinstall, no migration — lifting the caps and adding offline / air-gapped activation, SSO, white-label, enforced coverage, more nodes and the Nebula-hardened build. See Community Edition.
• AI & agent entitlements. License AI products and autonomous agents with the entitlement engine you already have — conventional signed keys (ai.enabled, allow-listed ai.models / ai.endpoints / ai.tools, and agent.budget.credits / agent.lease.seconds) read back offline with matching helpers on all four SDKs (info.Ai.AllowsModel(…), EnforceModel(…), AgentBudgetCredits). Wildcard allow-lists, fail-closed, per-agent budgets metered through the existing credit pool. See Gate features.
• Sell through Stripe, Lemon Squeezy, Paddle & FastSpring — no integration code. Built-in webhook handlers at POST /webhooks/commerce/{provider}/{tenant} verify each provider’s native signature (constant-time) and read the Keyright product, tier and seat count from the order’s own metadata (keyright_product / keyright_tier / keyright_seats) to mint and email the key. Idempotent per order, refunds revoke, failed payments suspend — all on your existing tenant webhook secret. See Auto-issue keys from a store.
• MCP server & SDK wizard in the CLI. keyright mcp exposes minting, lookup, listing, revocation and stats as Model Context Protocol tools an AI assistant can call (stdio JSON-RPC, scoped by KEYRIGHT_MCP_TOKEN); keyright wizard generates ready-to-paste SDK snippets across five machine operations in all four languages.
• SDKs — the AI-entitlement helpers (.Ai / .ai / .ai()) ship in the 2.9.0 release of all four SDKs and read the same signed entitlements; no re-keying.
• Evaluate in one guided run — no key, no code, no database to provision. Install, run install.cmd, and a polished first-run wizard takes you from zero to a working license on your own server: a one-click built-in PostgreSQL (bundled in the Windows download, nothing to install, works on a clean machine) or your own, an automatic 3-day pre-trial (machine-bound, no email), and a one-time admin token to sign in and stay in the app. Then an in-app walkthrough has you create a product, issue a key, and watch a real activation take a seat — with a ready-made command for your shell (PowerShell, Windows CMD or macOS/Linux), a live seat meter, and resume-where-you-left-off. No setup code, no license key required to begin.
• The pre-trial can’t be gamed. The 3-day grant is signed and mirrored to the database as well as to disk, so it can’t be hand-edited to extend it and (on your own PostgreSQL) survives re-imaging the app box; reinstalling can’t reset the clock. When it expires the instance moves to a permanent read-only grace — issued licenses keep validating and leasing, only new or expanded issuance stops — so an evaluation never goes dark.
• Activate a trial or license key from the dashboard — enter or replace a key in Settings and it applies immediately, no restart and no reinstall: the natural next step after your pre-trial, and how a trial becomes a full license.
• Uninstall in one click — uninstall.cmd (in the download and copied into the install folder) removes the Windows service or IIS site; your data is kept unless you pass -Purge. install.cmd /? and uninstall.cmd /? list every option.
• Version & release coverage — define which releases each license may run as a signed, tier-gated coverage block, so you can sell upgrades and control exactly what a customer is entitled to run (KEYRIGHT_COVERAGE_PLANS); lower tiers still get a signed-but-unenforced block so end customers are never locked out.
• Check for updates & in-app feedback — a manual “Check for updates” compares your version against the release feed (never auto-installs; air-gapped instances skip it), and you can send feedback or a bug report from the dashboard carrying only product, version and OS — never keys, customer data or your protected code.
• Eval-only usage telemetry — anonymous usage reporting is scoped to unlicensed evaluation only, stops the instant the instance is licensed, buffers locally across restarts, and turns off completely when air-gapped or KEYRIGHT_NO_TELEMETRY is set. See exactly what is and isn’t collected on the telemetry page.
• Hardening — trials are one per mailbox (+tag subaddressing normalized; uniform responses, no account-existence oracle); baseline security headers (X-Content-Type-Options: nosniff, X-Frame-Options: DENY, Referrer-Policy, HSTS — tune with KEYRIGHT_HSTS); customer emails set Reply-To to your support address.
• Upgrade & first-run polish — reinstalling over an existing install now opens the dashboard correctly (an already-configured instance no longer 404s at its root URL), and the guided walkthrough gained refinements: the first field is focused on each step, the setup screen shows its icon, activation status refreshes the moment you reach the status step, and finishing takes you straight to the dashboard.
• Self-hosted image — ghcr.io/delta1-labs/keyright:2.9.0.

2.2.2

Released 2026-10-01.

• Self-hosted image — the self-hosted issuing-service image ghcr.io/delta1-labs/keyright:2.2.2 adds the changes below.
• Configurable email alerts — set your SMTP and choose exactly which events email you, each with its own recipient list (dashboard → Settings → Email alerts). Alerts include customer license expiring/expired/seat-limit and — importantly for self-hosted — your instance’s own license approaching expiry, entering grace, or gating, so a fail-closed instance never stops unexpectedly. A “send test email” button verifies your settings.
• Diagnostics — every server error is logged with a short correlation id that’s also returned to the caller (X-Keyright-Error-Id), so a report maps to one log line; a new GET /admin/self-diagnostics reports version, database reachability + pending migrations, license phase, enabled features, SMTP/alert status and uptime — and answers even when the instance is gated.
• Cold-start resilience — startup retries the database connect/migrate with backoff (tune with KEYRIGHT_STARTUP_DB_RETRIES), so an instance that has been idle serves only once its database is reachable (no first-request errors after idle).
• 2.2.1 hardening — the alert “send test email” now fails fast with a clear error on a bad/unreachable SMTP host (a 15s timeout) instead of hanging; small diagnostics polish.
• Dashboard tier & trial management — edit or delete existing product tiers in place, and configure the self-service trial (default length in days, tier and seats) right from the product page.

1.2.0

• Deactivation in every SDK — deactivate() releases an activated seat from the current machine (online), so a customer can move a single-seat license to a new device without contacting you.
• Offline lease import — importOfflineLease() lets an air-gapped machine verify a lease file you issued by hand, matching the online activation path byte-for-byte.
• Richer documentation — a complete client walkthrough per language, a raw-HTTP integration guide (including how to verify a lease signature yourself), and an illustrated admin-dashboard tour.

1.1.0

• Self-service free trials — enable per-product trials, let customers self-serve a trial key from your own site, and hand out offline trial files for air-gapped evaluators.
• Trial-lease fix — online activation now propagates the trial flag through the signed lease, so trial licenses enforce their evaluation rules under online activation exactly as they do offline. SDKs updated across all four languages.

1.0.0

• First public release — licensing infrastructure for software vendors: issue and enforce licenses without building your own server.
• Postgres-backed issuing service — an ASP.NET Core Minimal API that signs offline license files and online activation leases with per-tenant RSA keys.
• Node-locking and seats — a single-seat license cannot run on two machines, even offline.
• Entitlements and tiers — carried in the license, so your app can gate features by plan.
• SDKs for .NET, Node.js, Python and Java — each verifying the identical signed format against your embedded public key, plus a raw HTTP API for any other language.
• Multi-tenant — per-tenant signing keys, and wire-compatible with Nebula.NET’s licensing.

Questions or found a bug? Contact us.