Licensing

Pia Server reads its active licence at startup and exposes the current state on the License page (/admin/license).

What’s on the License page

• Edition — Community, Pro, Cloud, etc.
• Licensed to — name and email recorded when the licence was issued.
• Expires at — UTC instant, with a colour-coded badge (green / amber / red).
• Seat counts — MaxUsers, MaxAdmins, plus current usage.
• Feature flags — comma-separated list (e.g. LocalAuth, OAuth, AiProxy, Sync, AdminDashboard, E2EE).

The same data drives the global License status banner that appears across the admin UI when the licence is missing, expired, or near expiry.

License events

/admin/license-events shows the audit trail: licence loaded, refreshed, expired, replaced. Useful when investigating why the server’s behaviour changed at a particular moment.

Issuing a license

Pia uses the pia-license CLI tool to mint and verify licence files. The keypair must be created once per environment and the public key embedded in the server before the binary is shipped.

# 1. Create a keyset (once per environment)
.\pia-license.exe gen-keys --out audience --passphrase 123

# 2. Issue a licence
.\pia-license.exe issue \
    --private-key .\test\private.encrypted.txt \
    --passphrase 123 \
    --edition Cloud \
    --name dev1 \
    --email marco.altmann@neo42.de \
    --max-users 100000 \
    --max-admins 100 \
    --features LocalAuth,OAuth,AiProxy,Sync,AdminDashboard,E2EE \
    --out cloud.xml

# 3. Embed the public key
#    Paste it into LicenseKey.cs before building the server.

Keep the private key offline

The private key signs every licence ever issued for this audience. If it leaks, anyone can mint a licence with arbitrary seats and features. Store it in a secrets manager and never commit it.

Installing a license on the server

Drop the issued .xml file onto the server (the path is set by License:Path in appsettings.json, default licence.xml next to the binary). Restart the server, and the new licence becomes active.

What happens at expiry

When the licence expires the server enters a read-only mode: existing users can still sign in and pull, but write paths (sync push, admin actions, AI proxy) are disabled. A renewed licence brings the server back to full service immediately on next request — no restart needed.