The licence

A self-hosted Crosdesk runs on a licence key: a signed block of text, issued by Buddhyantra, that says whose installation this is and until when it may be used. This page covers getting one, installing it, what it contains, what happens when it lapses, and renewing it.

Getting a licence

Write to hello@buddhyantra.com with your organisation's name. The licence comes back as a block of text — keep the message: it is the copy to paste again if the installation is ever rebuilt.

What a licence contains

Expiry date	The last day the installation may be used. Inclusive: a licence expiring 31 March 2027 works all through that day, until midnight UTC.
Licensed to	The customer's name, and a customer id. For identification only — nothing depends on it.
Plan	Community (free, up to five users), Team, Department, Organisation or Enterprise — the band it was sold as. A name shown on the console; the limit below is what counts. A licence with no plan reads as Enterprise.
User limit	How many people the installation may hold — see The user limit. A licence with no limit is unlimited, and every licence issued before limits existed has none.
Workspace limit	How many organisations (workspaces) may be active at once — see The workspace limit. Unlimited when the licence names none.

There are no other limits: no cap on projects or storage, and no features switched on or off by the licence. One licence covers the whole installation — every workspace on it.

The key is checked entirely on your server. It is signed by Buddhyantra, and the image carries the matching public key to verify it. Crosdesk never contacts Buddhyantra or anyone else to check a licence, so an installation with no internet access works exactly the same.

Installing or replacing it

1. Sign in to /super-admin — the operator console, not a workspace. See First boot if it has not been claimed.
2. Open Settings → Licence.
3. Paste the whole key into licence.key and save. Copy it exactly — a key with a character missing is reported as Invalid.

It takes effect on the next request: no restart, nothing else to change. Replacing a licence is the same steps — the new key overwrites the old one.

A licence the installation already breaks is refused, and the old one stays in force. Saving one says what is wrong: more users in use than it allows, more active workspaces than it allows, or a workspace whose own user limit is above the licence's (see Workspace plans). Free the seats, archive a workspace or lower that workspace's limit, then save it again.

The key is stored encrypted in the database and is never shown again, not even to the operator. That encryption uses the installation's CONFIG_ENCRYPTION_KEY; if it is not set, saving is refused with CONFIG_ENCRYPTION_KEY is not set on this server, and the app warned about it when it started — see Installing.

A LICENSE_KEY environment variable does nothing. The console is the only place a licence is read from, so there is never a question of which of two copies is in force.

Its status

Above the field, the console shows the installed licence — who it is licensed to, when it expires, and one of four statuses:

Status	Means	Workspaces
Valid — 120 days remaining	In force. Turns amber in the last 30 days, as a reminder to renew. Expires at the end of today on its final day.	Work normally
Expired	The expiry date has passed.	Refused
Invalid — Could not be verified: …	The key is damaged, incomplete, or not issued for Crosdesk. The reason is given.	Refused
Not set	No licence has been installed.	Refused in production

The user limit

A licence with a user limit holds the whole installation to it — every workspace together, not each one. The console shows where you stand on Settings → Licence, People and Invitations:

In use	Active plus invited — the number the limit is held against
Active	People who can sign in to at least one workspace
Invited	Addresses with a pending invitation that has not expired, and no active account
Archived	Accounts the operator archived — not counted, shown so you can see what un-archiving would add

Each person counts once, however many workspaces they are in or invited to. An invitation takes a seat when it is sent, so accepting one is never refused. Not counted: someone disabled in every workspace they belong to, anyone the operator archived or removed, invitations that were cancelled, refused, accepted or have expired, and the people of an archived organisation.

At the limit, anything that would add somebody is refused with a message naming the plan and the numbers:

This installation's Team licence allows 40 users and all 40 are in use. Ask your Crosdesk operator to upgrade the licence, or free a seat by cancelling an invitation or archiving someone.

That covers inviting someone new, re-sending an invitation that had ended, re-enabling a disabled person, signing up for a new workspace, and — on the console — creating an organisation, un-archiving a person and restoring an archived organisation. Inviting someone who already counts — active in another workspace, or already invited — is always allowed.

To free a seat, cancel a pending invitation on the console's Invitations page, have a workspace admin disable someone, or archive a person on People. To raise the limit, install a licence with a larger one.

Over the limit — which a licence can no longer cause, since one that does not fit is refused — nobody loses access. New people are refused until the count is back under, and the console says by how many it is over.

The workspace limit

A licence with a workspace limit caps how many organisations are active on the installation at once. An archived organisation does not count, so archiving one frees its place. The console shows Workspaces — 2 of 3 beside the user counts, with how many are archived.

At the limit, these are refused with a message naming the plan and the numbers:

• creating an organisation on the console;
• restoring an archived organisation;
• self-serve sign-up, which gives each new person a workspace of their own — the sign-up page says so before anyone is sent a code.

Creating an organisation also invites its first administrator, so it needs a free seat under the user limit as well; whichever limit is reached is the one the message names.

Workspace plans

On a cloud installation, where each workspace is sold its own plan, the operator gives a workspace a plan name and a user limit of its own: Organisations, the pencil on its row. Both are optional — a workspace starts with no plan and Unlimited, and choosing those again puts it back.

Plan name	Any name — Free, Starter, Pro. Shown to the workspace's administrators and on the console.
User limit	How many people the workspace may hold, counted as the licence counts them but within that workspace: active members and pending invitations, each once.

Both limits apply. Adding someone to a workspace needs room in the workspace's limit and in the licence's: whichever is full refuses, and the message names it. Someone active in another workspace on the installation adds nothing to the licence's count but still takes a seat in this workspace.

A workspace's limit can never be set above the licence's user limit, nor below the people it already has — both are refused with a sentence saying which.

The free account. With self-serve sign-up on, Settings → Security → signup.freeUserLimit gives every workspace that sign-up creates a user limit of its own from the start, under the plan name in signup.freePlanName (Free unless changed). Empty — the default — leaves them unlimited. It counts the owner, so 1 is a workspace of one. It applies only when the workspace is made: changing it later leaves existing workspaces as they are, and the operator raises or clears one with the pencil on Organisations like any other. Workspaces the operator creates are not touched. Like any workspace limit it cannot be above the licence's user limit, and a licence below it is refused until it is lowered. The workspace's administrators see the plan, the limit and the people counted on My profile → Access; other members do not.

When it is not valid

Every workspace request is refused, for every person in every workspace. The app answers each one with status 451 and a message that says what is wrong and what to do:

This Crosdesk licence expired on 2027-03-31. Contact your administrator to renew it.

What keeps working, on purpose:

• The operator console, /super-admin — it is where a new licence is installed, so it is never locked out.
• The health checks, /api/health and /api/health/ready — so a container platform does not mistake a lapsed licence for a crashed app and restart it over and over.

Nothing is deleted or changed. Projects, tasks, files and accounts stay exactly as they were, and everything is back the moment a valid licence is saved. No background jobs depend on the licence either: the nightly clean-ups still run.

A licence that expires while the app is running is noticed within the hour. To have it checked more often, set LICENSE_CACHE_TTL_MINUTES (default 60) in the environment.

Renewing

1. Write to hello@buddhyantra.com for a renewed licence before the expiry date — the console turns amber 30 days ahead. Quote the Licensed to name and customer id from the Licence screen.
2. Install the new key as above. Its expiry shows at once; nothing else is needed.

If it has already expired, the same steps restore service immediately.

Test and evaluation installations

The rules relax only for an installation that is not running in production mode (NODE_ENV other than production — never the case for the published image):

• No licence at all is allowed, so a developer's machine or a test suite runs without one. The console shows Not set — allowed because this is not a production build.
• A broken or expired licence is still refused. That is a fault, not an absence.

Troubleshooting

What you see	Why, and what to do
Every workspace screen fails; the console says Not set	No licence installed yet. Paste one in Settings → Licence.
Saving the licence says CONFIG_ENCRYPTION_KEY is not set on this server (or must decode to 32 bytes)	Set it — openssl rand -base64 32 — restart, and save again.
Invalid — Could not be verified right after pasting	The key was cut short or changed while copying. Copy it again from the original file or message.
Not set after restoring a backup onto a new server, though a licence was installed	The new server has a different CONFIG_ENCRYPTION_KEY, so the stored licence cannot be read and counts as absent. Start it with the original key — see Backups — or paste the licence again.
Expired, though a renewal was ordered	The new key has not been installed. Paste it in Settings → Licence.
The health check passes but nobody can use the app	Expected while the licence is not valid: health checks are deliberately exempt. Check the Licence screen.

LICENSE_PUBLIC_KEY and LICENSE_PUBLIC_KEY_PATH exist for Buddhyantra rotating its signing key; leave them unset unless Buddhyantra tells you otherwise.

Related

• First boot and the operator console
• Upgrading and backups