Licensing
How licensing works
Written for the people who approve software for restricted networks: what each licensing mode needs, what it sends, and how long a license keeps working without contact.
Three ways to license a machine
1. Online, with a license key
For machines that can reach license.nubestack.com over HTTPS. Paste the key once; the app renews a 30-day license about every 24 hours and keeps working for up to 30 days if it cannot connect.
2. Offline, with a request code
For machines with no network route. The app shows a 25-character code; an administrator enters it in the portal on any connected computer and carries back a signed license file. The offline machine never makes a connection.
3. Deployment license
For sites where not even a code may leave. NubeStack approves an organisation-wide license file covering a stated number of seats, which IT deploys with its usual tools. Nothing leaves the site at any point.
What the license check sends
Only online activation (mode 1) makes network requests, and only to license.nubestack.com. Each request contains:
- the license key, only on first activation (renewals prove possession with a per-device secret instead of re-sending it);
- a device fingerprint: a one-way SHA-256 hash of the machine ID, the operating-system user and the product name;
- the device label you choose, the operating system family and the app version;
- a random nonce and timestamp that stop requests being replayed.
It never sends host names, user names, IP addresses of your servers, connection details, terminal output, AI prompts or usage data. Offline and deployment licenses send nothing at all, and administrators can disable online activation entirely by policy.
Network and proxies
Online activation needs outbound HTTPS (port 443) to license.nubestack.com and nothing else. The app uses the operating system’s proxy settings and trusted root certificates, so TLS-inspecting proxies work: licenses are protected by digital signatures, not by the connection.
How long a license keeps working
| Situation | Validity |
|---|---|
| Online machine that cannot reach the license server | Up to 30 days from its last successful check |
| After a renewal payment fails or a subscription ends (online) | 7 more days after the paid period |
| Offline license files and deployment licenses | The paid period plus 14 days (at most 400 days per file) |
| Files issued in the first 60 days of a new card subscription | Until day 74; the full-term file is available from day 60 |
| Invoiced subscriptions awaiting payment | Until 15 days after the invoice due date, then the full term once paid |
When a license expires, only the AI features stop. The terminal, saved connections and every setting keep working, and a renewed license restores the AI features immediately. Offline sites get reminder emails 30, 14 and 3 days before their newest files expire.
Seats and devices
Each seat is one person, with its own key, on up to 2 machines (online and offline activations count together). Replacing a machine is self-service: release the old device in the app or the portal. A few releases per month take effect immediately; beyond that a released device frees its slot when its license would have expired, which keeps keys from being passed around. Online devices that stop checking in are released automatically after 45 days.
Verifying licenses yourself
License files are plain text (.opslic) containing a JSON Web Signature (ES256). The app trusts only the NubeStack public keys built into it and never downloads keys. The current public keys are published at /.well-known/nubestack-license-keys.json for your security team to inspect.