Get and apply a license

DVARA is an AI governance platform, and every self-managed install is activated by a signed license key. Without a valid key the DVARA LLM Gateway, DVARA Flightdeck, and DVARA MCP Proxy refuse to start — the governance layer never comes up unlicensed. This page covers the full lifecycle: requesting a license, applying it, verifying it, renewing it, and exactly what the data plane does as a license approaches and passes expiry.

Request a license

Both paths are fulfilled by an emailed DVARA--prefixed envelope, usually the same business day:

• Trial — a 30-day license with every feature unlocked, for evaluation. Request one by booking a slot (mention you need a trial license for a self-hosted install), or — if a corporate proxy or air-gapped network blocks the form — email support@dvarahq.com with your name, work email, company, and use case.
• Production — an annual license issued with your plan. Talk to us to start a production license or renew an existing one.

The license is install-wide: a single envelope activates all three planes (LLM Gateway, Flightdeck, MCP Proxy). There are no per-tenant or per-node keys to mint, and the envelope is not tied to a specific host — so staging, CI, and DR copies of the same install use the same key.

Apply the license

Set the envelope on every DVARA app via the DVARA_LICENSE_KEY environment variable (or the dvara.license.key config property):

# .env — the same envelope on every plane
DVARA_LICENSE_KEY=DVARA-<your-license-envelope>

Each app validates the envelope at startup: it verifies the Ed25519 signature against the public key shipped in the image and checks the expiry date. An invalid, tampered, or missing key blocks startup with a clear error — there is no operator flag to bypass the check, by design (a governance layer that silently runs unlicensed would defeat the audit story).

• Docker Compose — put DVARA_LICENSE_KEY in .env (see the Quickstart).
• Kubernetes — store the envelope in a Secret and reference it on the Gateway, Flightdeck, and MCP Proxy pods (see Kubernetes).

Restart the apps after changing the key.

Verify the license

Open License from the DVARA Flightdeck user menu (or go to /license). It shows the licensee, type (TRIAL / PRODUCTION), expiry date with days remaining, and a runtime status badge — see Operations → License status for the full page.

Programmatically, the Gateway's GET /actuator/gateway-status endpoint returns the license block; it requires Authorization: Bearer $DVARA_ACTUATOR_API_KEY.

What happens as a license expires

The runtime tracks four states. The transition that matters operationally is into DEGRADED:

Status	When	Data-plane behavior
VALID	More than 30 days remaining	Normal.
EXPIRING_SOON	30 days or fewer remaining	Still serving. An X-License-Warning header is added to /v1/* responses; the License page shows a renewal notice.
GRACE_PERIOD	Expired, within the 14-day grace window	Still serving. X-License-Warning continues. Renew now.
DEGRADED	Expired beyond the 14-day grace	The data plane refuses /v1/* with HTTP 402 (type: license_error, code: LICENSE_EXPIRED). The Flightdeck Console and existing audit records stay accessible so you can diagnose and renew.

The X-License-Warning header appears throughout EXPIRING_SOON and GRACE_PERIOD — wire it into your SRE alerting so a renewal lapse never reaches DEGRADED. Status transitions also emit LICENSE_EXPIRY_WARNING, LICENSE_EXPIRED, and LICENSE_DEGRADED audit events.

Renew before the grace window ends

Once a license passes the 14-day grace into DEGRADED, the data plane stops serving /v1/* (HTTP 402 — see Error handling). The Console stays up for renewal, but production model traffic is interrupted. Renew during the EXPIRING_SOON window, well before the grace period expires.

Renew a license

1. Request the renewed envelope (production: through your account contact; trial → production: talk to us).
2. Replace DVARA_LICENSE_KEY with the new value on every plane.
3. Restart — a rolling restart keeps the fleet serving. The License page reflects the new expiry.

Renewing before expiry avoids the warning → grace → degraded cascade entirely. The same swap upgrades a trial to a production license.

Related

• Operations → License status — the Flightdeck License page in detail.
• Response headers → X-License-Warning — wiring expiry warnings into alerting.
• Error handling → LICENSE_EXPIRED — the 402 the data plane returns when DEGRADED.
• Deployment models — self-managed vs managed hosting.