Licensing
How activation, signed validation and the 7-day offline window work.
Get a key
Every mlab.sh organisation has a free IR license auto-provisioned. Find it under Organization > Incident Response on mlab.sh and paste it into LICENSE_KEY in your .env.
Validation flow
ir.mlab.sh 1.1.0 uses signed licenses. It needs mlab.sh 1.21.5 or later.
- On boot and then once an hour,
appsendsLICENSE_KEYtomlab.sh/api/v1/ir/license/validate, together with this instance's own id (drawn once, at first boot), its IR version and its hostname. - When the license belongs to this instance, mlab.sh answers with the license signed with its Ed25519 key. The instance checks the signature against the public key compiled into it, so a server that is not mlab.sh can never make an instance licensed.
- The signed license is kept in the database. It stays valid for 7 days after it was issued and is renewed every hour, so the platform keeps running across restarts and while mlab.sh is unreachable.
- The web console is locked when there is no valid license: no key, an unknown key, the license held by another instance, or a kept license that expired. Data is never deleted.
- As soon as a check succeeds again, the lock clears on its own.
One license, one instance
A license runs one instance at a time. When another instance holds it, the locked page and Settings > License name that instance and when it last checked in, and offer Use this instance to an administrator, which moves the license here. Moving it locks the other instance at its next check.
A replacement server is covered too: once the old instance has been silent for 3 hours, the new one takes the license over at its next check.
License management lives on mlab.sh. Upgrades, downgrades, key rotation, deactivation - all happen at mlab.sh/orga/ir/license. The ir.mlab.sh instance only reads the current state.
Tiers
| Tier | Users | Alerts / month | Cases / month | Support |
|---|---|---|---|---|
free | 3 | 10 | 5 | Community |
lite | 10 | 200 | 50 | |
company | 50 | 3,000 | 500 | Priority email |
corpo | ∞ | ∞ | ∞ | Priority + SLA |
See the pricing page for the full comparison.
What if I hit a limit?
You get a banner in the UI and a warning event in the audit log. The platform keeps running - we don't drop incidents on the floor - but you'll need to upgrade to receive more ingestion the next month. Upgrades take effect within the hour without restart or reinstallation.
Network requirements
The app container needs outbound HTTPS to mlab.sh (443) for the hourly license check. That's the only egress required. No telemetry, no usage analytics, no error reporting. The check sends the license key, the instance id, the IR version and the hostname, nothing else.