A licence check with no licence server

If the whole point of a product is that nothing leaves your network, the licence check cannot be the exception. So the gateway has no activation server, no licence API, and no “phone home” of any kind. Here is how it works instead.

The token

A licence is one line beginning twl1.. It carries a few claims: the organisation, the seat count, an issue date and an expiry date, an optional contact email, and the features it switches on (policy, recording, plugins). Those claims are signed with Ed25519 by a private key that lives with us. The matching public key is compiled into twinny-server.

Installing it is twinny-server license set twl1.…, or pasting it on the admin page. The gateway verifies the signature against its built-in keys, reads the claims, and applies them within a second, no restart. A token that does not verify changes nothing.

That is the entire check. It works on a machine that has never seen the internet. The verification code is in the public repository under src/licensing; the only private part is the signing key.

Seats

A seat is an active key on the gateway. Every developer has their own key, so seats are developers. Revoking a key frees its seat at once, so offboarding someone and onboarding their replacement costs nothing. The first five seats are free for everyone, permanently, without a token. A team licence carries the total seat count, the free five included.

When it lapses

Because nothing calls home, a lapsed licence has to degrade gracefully on its own:

• 30 days before expiry the admin page, the startup banner and the log say so.
• After expiry there are 14 days of grace with everything still applied.
• After the grace the free plan applies. Policy, recording and plugins switch off. Existing keys are not deleted: the five oldest keep their seats, and the rest are refused with a clear message until the licence is renewed or keys are revoked. The admin key made on day one is the oldest, so an operator is never locked out of their own gateway.

A renewal is a new token with the same licence id and a later expiry. You copy it from your licence page, or from the renewal email, and install it the same way.

What we never learn

Nothing. The gateway does not report seats in use, versions, usage, or whether the licence is installed. We know a licence was issued because we issued it, and that is the end of our knowledge. A 30-day trial token is issued the same way and expires the same way.

The full page, with the CLI output and the exact grace rules, is Licensing and seats.