Skip to content

Self-hosting

Community Edition

Run real Keyright licensing free as the single-node Community Edition — up to 100 active licenses and 1 product with online activation — then upgrade the same instance in place to lift the caps and add offline/air-gapped activation, SSO, white-label and more nodes.

New in 2.9.0. A self-hosted instance that isn’t licensed falls back to the free Community Edition — a real, working issuing service (within caps), never a lock-out.

Goal. Stand up real licensing for your product at zero cost, and pay only when you outgrow the free caps or need offline, SSO, white-label or more nodes.

The 3-day pre-trial, then Community

When you first start a self-hosted instance it runs a fully-functional 3-day pre-trial — every paid capability, no signup, machine-bound. If you don’t apply a license (or extend the trial) before it ends, the instance does not lock out: it automatically falls back to the Community Edition. Already-issued licenses keep validating throughout.

What you get free (Community Edition)

  • Up to 100 active (non-expired) licenses, across 1 product, on a single node.
  • Online activation, node-locking, seats, entitlements & tiers.
  • Online usage-based credit metering.
  • The customer self-service portal and self-service trials.
  • All four client SDKs — .NET, Node, Python and Java — verifying the same signed license and lease formats.
  • The admin dashboard, carrying a small “Powered by Keyright” footer.
  • Email support (no SLA).

What’s not in Community (upgrade to unlock)

These appear in the dashboard locked, with an upgrade prompt:

  • More than 100 active licenses, more than 1 product, or more than one node. Issuing past a cap fails closed with an upgrade prompt; everything already issued keeps working.
  • Offline / air-gapped activation — signed offline license files for your customers, and air-gapped credit blocks for offline metering. Community is online-activation only.
  • SSO (SAML / OIDC).
  • White-label — removing the “Powered by Keyright” footer.
  • Enforced release / version coverage.
  • The Nebula-hardened issuing build and the Windows installer with built-in PostgreSQL.
  • Vendor support with an SLA.

A fully air-gapped deployment therefore needs a paid self-license (Community is online-activation only).

Upgrading

Applying a paid self-license (KEYRIGHT_SELF_LICENSE) upgrades the same instance in place — no reinstall, no data migration. The caps lift, the footer goes, and the paid features unlock according to the tier. See Pricing for the self-hosted tiers, or Licensing & editions for how a self-license is applied.

How it works

The free/paid boundary is enforced by Keyright’s own self-license (the same dogfooding your customers’ apps use). With no valid paid license and no active pre-trial, a self-hosted instance runs as Community: the dashboard reports the edition as Community, writes (issuing) stay open within the caps, and the paid features are gated. Applying a self-license switches it to the paid edition and removes the footer. Node counts are a contractual term.

Verify

  1. docker pull ghcr.io/delta1-labs/keyright and run it with a PostgreSQL. It starts on the 3-day pre-trial — the dashboard edition reads Trial, and every paid feature is available.
  2. Let the pre-trial lapse with no license applied: the edition reads Community, the “Powered by Keyright” footer appears, issuing keeps working up to 100 active licenses on 1 product / 1 node, and the paid features show as locked.
  3. Try to issue a 101st active license (or create a 2nd product): it’s refused with an upgrade prompt, while existing licenses keep validating.
  4. Set KEYRIGHT_SELF_LICENSE to a paid key and restart: the edition flips to Standard / Pro / Enterprise, the footer disappears, and the caps and paid features unlock — same database, same licenses, no migration.

See also