Licensing
Gatewyse Enterprise is licensed software. Two principles govern everything below:
- No licence, no product. An unlicensed, invalid or revoked deployment locks
out: every request except health probes, admin sign-in and the licence
endpoints is refused with
403 license_required. - Capability is never gated. Providers, routing strategies, retrieval and model intelligence are what the gateway does, and every licence includes all of them. What ladders by edition is enterprise integration — identity, SIEM, cloud storage, and compliance surfaces.
Editions
| Starter | Business | Enterprise | Government (air-gapped) | |
|---|---|---|---|---|
| Users | Unlimited | Unlimited | Unlimited | Unlimited |
| Organizations & departments | Unlimited | Unlimited | Unlimited | Unlimited |
| All providers & routing | ✓ | ✓ | ✓ | ✓ |
| Retrieval & model intelligence | ✓ | ✓ | ✓ | ✓ |
| SSO — OIDC | — | ✓ | ✓ | ✓ |
| Custom roles | — | ✓ | ✓ | ✓ |
| Audit log access | — | ✓ | ✓ | ✓ |
| SSO — SAML 2.0 | — | — | ✓ | ✓ |
| SCIM provisioning | — | — | ✓ | ✓ |
| SIEM export | — | — | ✓ | ✓ |
| Encryption key rotation | — | — | ✓ | ✓ |
| S3 backups | — | — | ✓ | ✓ |
| Source access | — | — | ✓ | ✓ |
| Phone-home | Yes | Yes | Yes | Never |
| Lifetime updates | ✓ | ✓ | ✓ | ✓ |
Entitlements are decided by the licence’s features[] list and its capacity
caps — never by the tier name. A bespoke agreement is a custom feature list
on an otherwise standard licence, which is why non-standard deals need no
special build.
Installing a licence
Three sources, in precedence order. The first one present wins.
LICENSE_TOKEN— the token itself, as an environment variable.LICENSE_TOKEN_FILE— a path to a file containing the token. Preferred for Docker/Kubernetes secrets.- Admin upload —
POST /api/admin/license, or the License page in the admin UI.
An environment or file token always outranks an uploaded one, so an upload can never silently override infrastructure configuration. Removing an uploaded licence falls back to the environment rather than disabling the deployment.
LICENSE_PUBLIC_KEYS must contain the issuer’s Ed25519 public key(s) in SPKI
PEM format. Multiple keys are separated by ;;, and each may carry a
kid:<id>=<pem> prefix so key rotation does not invalidate issued licences.
Verification is offline
The licence is a signed JWT (Ed25519 / EdDSA). It is verified locally against keys shipped with the release: no network connection is required to start or to run, and verification keeps working forever.
Licence states
| State | Meaning | Behaviour |
|---|---|---|
verified | Valid licence | Normal service |
absent | Dev mode, no token | Everything unlocked (never in production) |
unverified | Missing, malformed or unverifiable | Locked out |
| revoked (in grace) | Revoked, within 7 days | Normal service, banner shown |
| revoked (past grace) | Revoked, grace elapsed | Locked out |
The server never exits on a licence failure. It starts, refuses traffic, and keeps the recovery path open — otherwise fixing a bad token would require shell access to the container.
What stays reachable while locked out
/health · /ready · /api/admin/auth/* · /api/admin/license*
Everything else, including /v1/* and /metrics, is refused.
Dev mode
LICENSE_MODE controls enforcement explicitly:
LICENSE_MODE=dev— run unlicensed, all features on. Refused in production.LICENSE_MODE=enforce— enforce even in development, to exercise licensed paths locally.- Unset — dev mode outside production, enforcement in production.
Capacity
0 means unlimited. Caps are checked at creation only and never deactivate
something that already exists, so a change of edition cannot interrupt service to
users already in the system, and first-run setup is never blocked.
The seat cap is the only cap that is enforced. It is checked when a user is created. No shipped edition sets a non-zero value, so in practice every edition is unlimited on seats.
A tenantCap is present in the token and reported by the licence panel, but
nothing gates on it. A deployment has exactly one tenant, created at boot,
and no route creates another — so a cap on the number of them has no entry point
to guard. It stays in the payload because it is the issuer’s vocabulary, shared
across every product it licenses, and a claim an older build cannot parse must
never brick that build. Do not plan capacity around it.
Phone-home and revocation
Non-air-gapped deployments check revocation status once a day against
license.137andco.com.
- Sent: the licence ID. Nothing else — no telemetry, no usage data, no prompt or response content.
- Unreachable is never revoked. A network fault, firewall change, DNS failure or licence-server outage changes nothing; the deployment carries on indefinitely. Verification is offline-first, so an unreachable issuer tells us nothing about validity.
- Revocation starts a 7-day grace period measured from the issuer’s revocation timestamp. During grace, service is normal and the admin UI shows a banner. After grace, the deployment locks out.
- Revocation survives a restart — it is recorded locally. Installing a different, valid licence clears it, which is how a customer recovers.
Government (air-gapped)
Government licences carry a signed airgap claim and never contact 137 & Co.
at all — no revocation check, no update check, no outbound connection.
Air-gap is a property of the signed licence, not a configuration setting, so it cannot be enabled by editing the environment.
Error responses
Missing entitlement:
{ "error": { "message": "The \"siem-export\" feature is not included in this deployment's licence. Upgrade the licence to activate it.", "type": "license_required", "code": "license_required", "param": "siem-export" }}Locked out:
{ "error": { "message": "A valid licence is required to operate this deployment...", "type": "license_required", "code": "license_required" }, "locked": true, "state": "unverified", "reason": "license_token_missing"}Capacity exceeded:
{ "error": { "message": "Licence seat cap reached (25/25). Upgrade the licence to add more users.", "type": "license_cap_exceeded", "code": "license_cap_exceeded", "param": "seats" }, "used": 25, "cap": 25}FAQ
Does the licence expire? No. Licences are perpetual. Revocation is the only mechanism that ends the right to operate.
Do I have to pay for updates? No. Lifetime updates are included at every edition, for as long as the product is maintained.
Is support required? No. Support is a separate, optional arrangement. The first year of standard support is included; lapsing it affects neither the right to run the Software nor access to updates.
Can I move a licence between servers? Yes. It is a signed token, not a machine binding.
How many instances can I run? Unlimited within one production environment, plus unlimited non-production. Replicas and failover copies are not counted.
What happens if your licence server goes down? Nothing. Unreachability is never treated as revocation.
Can I resell access through Gatewyse? No — see LICENSE-TERMS.md §6.
Gatewyse is licensed for use in front of provider accounts you contract for
yourself. Reselling API access also breaches substantially all upstream provider
terms. For embedding Gatewyse in a product you sell, ask about an OEM licence.