> ## Documentation Index > Fetch the complete documentation index at: https://langwatch.ai/docs/llms.txt > Use this file to discover all available pages before exploring further. > ## Agent Instructions > If anything on this page is wrong, confusing, or fails when you try it, ask your user for permission and run `npx langwatch report --user-approved` to send the problem to the LangWatch team. No login is needed and secrets are redacted locally. `npx langwatch report --help` has the details. # Editions and licensing > What self-hosted LangWatch gives you for free, what an Enterprise license adds, and how to activate one Self-hosted LangWatch runs the same image that powers LangWatch Cloud. There is no separate "community" build to outgrow and no feature you have to re-deploy to obtain: a license enables the Enterprise surface in the software you are already running. ## What you get without a license There is no volume cap on what the platform stores on your own infrastructure. Running unlicensed, you get: > [card] Unlimited people > > Members, lite members, teams, and projects. Invite your whole organization. > [card] Unlimited work > > Traces, spans, prompts, evaluations, scenarios and simulations, agents, experiments, datasets, > dashboards, custom graphs, and automations. > [card] Full trace content > > No visibility window, so LangWatch never redacts older trace content. Events are kept for 49 days by default, and a license lets you set the retention window per organization, team or project. > [card] The whole product surface > > Observability, evaluations, prompt management, agent simulations, Workflows, and the AI Gateway. You never need a license just to run LangWatch. A license adds the enterprise capabilities below and a support relationship. > [!NOTE] > > An Enterprise license is priced per seat, so it carries the number of members you bought and the deployment enforces it. Everything else stays uncapped: volume, history, projects, teams, and every experimentation resource. Need more seats? [Talk to us](mailto:enterprise@langwatch.ai) and we reissue the license. > > Seats come in three kinds. Which of the first two a person occupies follows from what they can do rather than from a billing switch: someone who can change things holds a **full seat**, someone who can only read what the team produces holds a **lite seat**. Lite seats are counted separately, so read-only reviewers do not consume a full one. > > The third, a **Developer seat**, is for somebody who works in a project of their own and sees no shared project; it is counted but never limited by the license. See [Seats](https://langwatch.ai/docs/platform/members-and-teams.md#lite-members) and [Developers](https://langwatch.ai/docs/platform/members-and-teams.md#developers). > [!NOTE] > > Volume is bounded by your own hardware, not by us. A self-hosted deployment is not metered and > sends no usage back to LangWatch unless its license names a hosted service, in which case > [Connect](https://langwatch.ai/docs/self-hosting/connect.md) meters what that service judges or serves. ## What an Enterprise license adds | Capability | Why it is licensed | | - | - | | **SSO** (Auth0, Okta, Azure AD, Google, GitHub, GitLab) | Identity federation is the surface enterprises buy. See [SSO configuration](https://langwatch.ai/docs/self-hosting/configuration/sso.md). | | **RBAC** with custom roles | Fine-grained permissions beyond the built-in roles. | | **SCIM** user provisioning | Directory-driven joiner/mover/leaver flows. | | **Audit logs** | Tamper-evident record of who did what, exportable to your SIEM. | | **Gateway webhooks** | Signed delivery of spend and budget events from the AI Gateway to your own systems, with retries, replay and a delivery log. This is what platforms build their own usage-based pricing and agent budget controls on. | | **AI Governance** | Multi-source ingestion, anomaly rules, OCSF and SIEM export, [no-spy mode](https://langwatch.ai/docs/ai-governance/no-spy-mode.md). | | **Extended retention** | Multi-class retention policies configured per category. | | **Support and SLA** | Named contact, response targets, upgrade guidance. | A licensed install can also call LangWatch-hosted services, the Instant Evals judge and managed models, over one outbound connection. The license decides which of them this install may call, an organization admin can switch off the ones they do not want, and what you spend is metered and capped on the LangWatch side against your contract. See [Connect](https://langwatch.ai/docs/self-hosting/connect.md). The Apache 2.0 floor and the Enterprise line are drawn per directory in the repository: the implementations of these capabilities live under [`enterprise/`](https://github.com/langwatch/langwatch/tree/main/enterprise), covered by the [Enterprise license](https://github.com/langwatch/langwatch/blob/main/enterprise/LICENSE.md). See [Open-core licensing](https://langwatch.ai/docs/ai-governance/open-core-licensing.md) for the file-level map. ## SSO requires a license Setting the SSO environment variables is not sufficient on its own. A deployment with an identity provider configured but no license runs in **email mode**: the sign-in page offers the email and password form, the identity-provider button is not shown, and SSO sign-in routes are refused. This is deliberate rather than a failure state, so an unlicensed deployment always has a working door: * Email sign-up and sign-in stay available. * **Forgot password** stays available, so anyone whose account was originally created through an identity provider can recover through their inbox. It can only deliver if outbound email is configured; without it the screen says so rather than claiming a link was sent. Once a license is present **and the configured identity provider actually starts**, the deployment flips to SSO and the email routes close, so no password account can be minted on a licensed install. If `NEXTAUTH_PROVIDER` names a provider LangWatch does not recognise or one whose credentials are missing, the deployment stays in email mode with the email routes open even though it is licensed, so a typo in a provider name cannot lock everyone out. > [!WARNING] > > **Upgrading a deployment that predates this gate, where everyone signs in through SSO.** Before the license gate existed, the SSO environment variables alone were enough, so an unlicensed deployment can have a whole team of identity-provider accounts on it. > > Those accounts have no password, so the door back in is **Forgot password**, and that needs a working outbound email provider. Before upgrading, either configure an email gateway (see [Email](https://langwatch.ai/docs/self-hosting/configuration/email.md)) or set `LANGWATCH_LICENSE_KEY`, which keeps SSO on with no password and no email involved at all. > > If you are already in this position, setting `LANGWATCH_LICENSE_KEY` and restarting is the recovery. It needs only the key, as long as the identity provider variables that were already working are still in place: the key licenses SSO, it does not configure it. ## Two forms of license LangWatch issues a license in one of two forms, and the install tells them apart by shape: | Form | Looks like | Network | | - | - | - | | **Activation code** | `LW-XXXX-XXXX-XXXX-XXXX` | The install redeems it over outbound HTTPS to `connect.langwatch.ai` for a signed license and stores that on the organization. It works only with outbound access to that host. | | **Signed license key** | A long base64 string, also delivered as a `.langwatch-license` file | Verified locally. It works offline. | In configuration, one setting takes both: the `LANGWATCH_LICENSE_KEY` variable or the Helm value `app.license.key`. There is no separate variable for activation codes. On **Settings → License**, choose **Enter activation code** for a code, and **Enter license key** or **Upload license file** for a signed license key. The page detects the form, so a value pasted under the other option is still accepted. See [Connect](https://langwatch.ai/docs/self-hosting/connect.md#activate-with-a-code) for what redemption sends. ## Activating a license **1. Get a license** Email [enterprise@langwatch.ai](mailto:enterprise@langwatch.ai) or [talk to sales](https://langwatch.ai/get-a-demo). You receive an activation code or a signed license key. **2. Activate it** In the platform, go to **Settings → License**, choose **Enter activation code** and paste the code, or choose **Enter license key** or **Upload license file** for a signed license key, then choose **Activate License**. Prefer configuration over a UI step? Set the code or key as an environment variable instead: ```bash theme={null} LANGWATCH_LICENSE_KEY= ``` On Helm, the chart takes it inline or from a Secret you already manage: ```yaml theme={null} app: license: key: secretKeyRef: name: langwatch-license key: license ``` A signed license key set through configuration entitles the whole instance, so it does not have to be activated again for each organization the deployment hosts. It is also the recovery path for a deployment whose only administrators sign in through SSO: it needs no working login to take effect. **3. SSO turns on** Plan entitlements apply immediately. SSO turns on at once on the server that stored the license, and within a minute on every other replica, with no restart. The activation confirmation in the UI says so too. `LANGWATCH_LICENSE_KEY` and `app.license.key` are read at startup, so a change to the variable takes a restart. ## An activation code in the variable When `LANGWATCH_LICENSE_KEY` or `app.license.key` holds an activation code and an organization exists, the app redeems it at startup, before it decides SSO. It stores the signed license on the organization, the oldest one if there are several, so SSO is on in that same boot. * If an organization already holds a license, the code is not redeemed again, so a restart is a no-op. To change the license later, use **Settings → License** or put the signed license key in the variable. * On a fresh install with no organization yet, the code is redeemed when the first organization is created, and SSO turns on without a restart. * If redemption is refused, the app logs the reason and still starts. Causes: an unknown, expired or already used code, a code bound to another install, no outbound access to `connect.langwatch.ai`, or `LANGWATCH_CONNECT_DISABLED` set. The startup log names the form it found in the variable and what it did with it. ## Expiry The deployment keeps running on the day a license reaches its end date. No user is signed out, no membership is disabled, everyone keeps their access, and the Enterprise capabilities keep working. Losing company-wide login the morning a renewal slips is a worse outcome than serving a former customer for a few days, so the sign-in decision accepts any genuinely issued license regardless of its date, and logs a renewal reminder instead. The seat count keeps binding. A license we issued is a record of what was bought, so an expired one still covers the seats it sold: an organization holding more members than that is asked to disable the ones who no longer need access, and adding a new member is refused until the license is renewed. Everyone who already has a seat is unaffected. A license we did not issue is a different thing. Its numbers cannot be trusted, so an unreadable or altered key leaves the deployment on the uncapped open-source baseline, exactly as if it had never held a license. ## Renewal To renew offline, open **Settings > License**, choose **Replace license** and enter the new key or license file. The new license replaces the current one in one step, so the organization keeps its license the whole time. **Remove license** is only for leaving the Enterprise plan: it returns the organization to the open-source plan straight away. A license file is read by its content, so a file that a mail client renamed (for example to `.txt`) still works. ## Frequently asked > [accordion] Is there a user limit without a license? > > No. Members, lite members, teams, and projects are all uncapped on a self-hosted deployment without a license. > [accordion] Do I need a license for commercial use? > > No. The Apache 2.0 floor covers commercial use. A license is for the Enterprise capabilities > listed above and for a support relationship. > [accordion] One organization has a license. What about the others? > > The SSO gate is deployment-wide: one genuinely licensed organization enables SSO for the whole > deployment. Plan entitlements stay per organization. > [accordion] Does self-hosted send usage data to LangWatch? > > No, unless the license names a hosted service: [Connect](https://langwatch.ai/docs/self-hosting/connect.md) then meters what that service judges or serves, and the daily license sync reports your seat counts. A license that names none reaches no hosted service and the deployment is not metered. [Billable events](https://langwatch.ai/docs/pricing/billable-events.md) apply to LangWatch Cloud. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.