Editions and licensing

What self-hosted LangWatch gives you for free, what an Enterprise license adds, and how to activate one

Self-hosted LangWatch runs the same image that powers LangWatch Cloud. There is no separate “community” build to outgrow and no feature you have to re-deploy to obtain: a license enables the Enterprise surface in the software you are already running.

What you get without a license

There is no volume cap on what the platform stores on your own infrastructure. Running unlicensed, you get:

Unlimited people

Members, lite members, teams, and projects. Invite your whole organization.

Unlimited work

Traces, spans, prompts, evaluations, scenarios and simulations, agents, experiments, datasets, dashboards, custom graphs, and automations.

Full trace content

No visibility window, so LangWatch never redacts older trace content. Events are kept for 49 days by default, and a license lets you set the retention window per organization, team or project.

The whole product surface

Observability, evaluations, prompt management, agent simulations, Workflows, and the AI Gateway.

You never need a license just to run LangWatch. A license adds the enterprise capabilities below and a support relationship.

An Enterprise license is priced per seat, so it carries the number of members you bought and the deployment enforces it. Everything else stays uncapped: volume, history, projects, teams, and every experimentation resource. Need more seats? Talk to us and we reissue the license.

Seats come in three kinds. Which of the first two a person occupies follows from what they can do rather than from a billing switch: someone who can change things holds a full seat, someone who can only read what the team produces holds a lite seat. Lite seats are counted separately, so read-only reviewers do not consume a full one.

The third, a Developer seat, is for somebody who works in a project of their own and sees no shared project; it is counted but never limited by the license. See Seats and Developers.

Volume is bounded by your own hardware, not by us. A self-hosted deployment is not metered and sends no usage back to LangWatch unless its license names a hosted service, in which case Connect meters what that service judges or serves.

What an Enterprise license adds

Capability	Why it is licensed
SSO (Auth0, Okta, Azure AD, Google, GitHub, GitLab)	Identity federation is the surface enterprises buy. See SSO configuration.
RBAC with custom roles	Fine-grained permissions beyond the built-in roles.
SCIM user provisioning	Directory-driven joiner/mover/leaver flows.
Audit logs	Tamper-evident record of who did what, exportable to your SIEM.
Gateway webhooks	Signed delivery of spend and budget events from the AI Gateway to your own systems, with retries, replay and a delivery log. This is what platforms build their own usage-based pricing and agent budget controls on.
AI Governance	Multi-source ingestion, anomaly rules, OCSF and SIEM export, no-spy mode.
Extended retention	Multi-class retention policies configured per category.
Support and SLA	Named contact, response targets, upgrade guidance.

A licensed install can also call LangWatch-hosted services, the Instant Evals judge and managed models, over one outbound connection. The license decides which of them this install may call, an organization admin can switch off the ones they do not want, and what you spend is metered and capped on the LangWatch side against your contract. See Connect.

The Apache 2.0 floor and the Enterprise line are drawn per directory in the repository: the implementations of these capabilities live under enterprise/, covered by the Enterprise license. See Open-core licensing for the file-level map.

SSO requires a license

Setting the SSO environment variables is not sufficient on its own. A deployment with an identity provider configured but no license runs in email mode: the sign-in page offers the email and password form, the identity-provider button is not shown, and SSO sign-in routes are refused.

This is deliberate rather than a failure state, so an unlicensed deployment always has a working door:

• Email sign-up and sign-in stay available.
• Forgot password stays available, so anyone whose account was originally created through an identity provider can recover through their inbox. It can only deliver if outbound email is configured; without it the screen says so rather than claiming a link was sent.

Once a license is present and the configured identity provider actually starts, the deployment flips to SSO and the email routes close, so no password account can be minted on a licensed install. If NEXTAUTH_PROVIDER names a provider LangWatch does not recognise or one whose credentials are missing, the deployment stays in email mode with the email routes open even though it is licensed, so a typo in a provider name cannot lock everyone out.

Upgrading a deployment that predates this gate, where everyone signs in through SSO. Before the license gate existed, the SSO environment variables alone were enough, so an unlicensed deployment can have a whole team of identity-provider accounts on it.

Those accounts have no password, so the door back in is Forgot password, and that needs a working outbound email provider. Before upgrading, either configure an email gateway (see Email) or set LANGWATCH_LICENSE_KEY, which keeps SSO on with no password and no email involved at all.

If you are already in this position, setting LANGWATCH_LICENSE_KEY and restarting is the recovery. It needs only the key, as long as the identity provider variables that were already working are still in place: the key licenses SSO, it does not configure it.

Two forms of license

LangWatch issues a license in one of two forms, and the install tells them apart by shape:

Form	Looks like	Network
Activation code	LW-XXXX-XXXX-XXXX-XXXX	The install redeems it over outbound HTTPS to connect.langwatch.ai for a signed license and stores that on the organization. It works only with outbound access to that host.
Signed license key	A long base64 string, also delivered as a .langwatch-license file	Verified locally. It works offline.

In configuration, one setting takes both: the LANGWATCH_LICENSE_KEY variable or the Helm value app.license.key. There is no separate variable for activation codes. On Settings → License, choose Enter activation code for a code, and Enter license key or Upload license file for a signed license key. The page detects the form, so a value pasted under the other option is still accepted. See Connect for what redemption sends.

Activating a license

1. Get a license

   Email [e-mail] or talk to sales. You receive an activation code or a signed license key.

2. Activate it

   In the platform, go to Settings → License, choose Enter activation code and paste the code, or choose Enter license key or Upload license file for a signed license key, then choose Activate License.

   Prefer configuration over a UI step? Set the code or key as an environment variable instead:

   LANGWATCH_LICENSE_KEY=<your activation code or signed license key>
   

   On Helm, the chart takes it inline or from a Secret you already manage:

   app:
     license:
       key:
         secretKeyRef:
           name: langwatch-license
           key: license
   

   A signed license key set through configuration entitles the whole instance, so it does not have to be activated again for each organization the deployment hosts. It is also the recovery path for a deployment whose only administrators sign in through SSO: it needs no working login to take effect.

3. SSO turns on

   Plan entitlements apply immediately. SSO turns on at once on the server that stored the license, and within a minute on every other replica, with no restart. The activation confirmation in the UI says so too.

   LANGWATCH_LICENSE_KEY and app.license.key are read at startup, so a change to the variable takes a restart.

An activation code in the variable

When LANGWATCH_LICENSE_KEY or app.license.key holds an activation code and an organization exists, the app redeems it at startup, before it decides SSO. It stores the signed license on the organization, the oldest one if there are several, so SSO is on in that same boot.

• If an organization already holds a license, the code is not redeemed again, so a restart is a no-op. To change the license later, use Settings → License or put the signed license key in the variable.
• On a fresh install with no organization yet, the code is redeemed when the first organization is created, and SSO turns on without a restart.
• If redemption is refused, the app logs the reason and still starts. Causes: an unknown, expired or already used code, a code bound to another install, no outbound access to connect.langwatch.ai, or LANGWATCH_CONNECT_DISABLED set.

The startup log names the form it found in the variable and what it did with it.

Expiry

The deployment keeps running on the day a license reaches its end date. No user is signed out, no membership is disabled, everyone keeps their access, and the Enterprise capabilities keep working. Losing company-wide login the morning a renewal slips is a worse outcome than serving a former customer for a few days, so the sign-in decision accepts any genuinely issued license regardless of its date, and logs a renewal reminder instead.

The seat count keeps binding. A license we issued is a record of what was bought, so an expired one still covers the seats it sold: an organization holding more members than that is asked to disable the ones who no longer need access, and adding a new member is refused until the license is renewed. Everyone who already has a seat is unaffected.

A license we did not issue is a different thing. Its numbers cannot be trusted, so an unreadable or altered key leaves the deployment on the uncapped open-source baseline, exactly as if it had never held a license.

Frequently asked

Is there a user limit without a license?

No. Members, lite members, teams, and projects are all uncapped on a self-hosted deployment without a license.

Do I need a license for commercial use?

No. The Apache 2.0 floor covers commercial use. A license is for the Enterprise capabilities listed above and for a support relationship.

One organization has a license. What about the others?

The SSO gate is deployment-wide: one genuinely licensed organization enables SSO for the whole deployment. Plan entitlements stay per organization.

Does self-hosted send usage data to LangWatch?

No, unless the license names a hosted service: Connect then meters what that service judges or serves, and the daily license sync reports your seat counts. A license that names none reaches no hosted service and the deployment is not metered. Billable events apply to LangWatch Cloud.