Licence and plan

Admin, Licence (/admin/billing), gated by the billing.manage permission.

Shows your current plan, what it includes, and lets you enter or remove a licence key.

Entering a key

Paste the key you were issued and save. The instance verifies it locally and the plan takes effect immediately.

Licence keys are Ed25519-signed tokens. The instance holds only the public key and verifies the signature offline, so:

• There is no call home at sign-in.
• A network outage cannot disable your service desk.
• The vendor cannot silently change what you are entitled to.

If the plan changes, the plan.changed message is sent to staff who can manage billing, because modules appearing or disappearing without explanation is confusing enough to warrant an email. That message cannot be switched off.

What the licence carries

Plan and tier	Which set of modules is entitled
Included devices	The managed device count the price covers
Included technician accounts
Included tenants	For multi-campus
Expiry	When it needs renewing
Deployment binding	Optionally, which install it is for
Telemetry endpoint	Where usage counts are reported

See plans for what each tier includes.

Going over an included count

Nothing breaks. Overage accrues on the licence and is trued up at renewal as a single line, rather than raising a small invoice every month that finance has to process against a fresh purchase order.

Nobody gets locked out of a service desk because they enrolled a class set of iPads or hired a technician.

The panel does surface a customer whose device count has outgrown their tier, because that is the moment to have a conversation, before overage accumulates quietly for a year.

Telemetry

Instances report count-only usage to the vendor control plane every few hours.

What is sent:

• Number of technician accounts
• Number of managed devices
• Which modules are enabled
• The version and channel
• The deployment id

What is not sent: any name, any record, any ticket, any device serial, any connector credential, any content of any kind.

The endpoint normally comes from the licence itself.

Turning it off

Self-hosted deployments can disable it entirely:

USAGE_REPORTER_DISABLED=1

With it off, snapshots are still kept locally and can be exported from this screen, which is how a self-hosted customer reports usage for billing without phoning home at all.

Managed deployments report as part of the service.

Authentication and replay protection

The licence key is the credential used to report. The control plane checks the signature, the issuer, the audience, expiry, that the licence is not revoked, that the timestamp is within a replay window, and that the reporting deployment matches any binding on the licence.

A licence reporting from more than one install is surfaced as an alert rather than blocked, because a legitimate rebuild also produces a new install id. It wants a human glance, not an outage.

Billing never revokes anything

Entitlement lives in the signed licence your deployment already holds, not in the billing system. A school’s service desk keeps working through a billing outage, an expired card or a failed webhook.

A failed payment starts a conversation. Revocation remains a deliberate act.

Contracts are annual and invoiced annually, with automatic collection off, because most schools pay by transfer against a purchase order. A hosted payment page is available for anyone who would rather use a card or direct debit.

Removing a key

You can remove a licence key from this screen. Doing so reverts the deployment to its unlicensed state, which disables entitled modules. It is reversible: paste the key back.

Version information

This screen also shows the version, channel, commit and build time of the instance. It is what support will ask for first. The same information is available without signing in at /api/health/version.

Self-hosting and licences

A self-hosted deployment needs LICENSE_PUBLIC_KEY set in its environment so it can verify keys. This is the vendor’s public key and is the same value for every customer.

Key rotation is supported through a keyed map:

LICENSE_PUBLIC_KEYS='{"k_ab12cd34":"LS0tLS1CRUdJTiBQVUJM..."}'

And specific licences can be refused locally:

LICENSE_REVOKED_JTIS="..."

Full detail in environment variables.