Enter a licence#
A licence unlocks configuration changes. Reading never needs one. An unlicensed router
signs you in and shows every page, every counter, every log and the audit trail; it refuses
to stage, commit, roll back, install an app or run the reconcile loop, and answers those
requests with 402 and a line naming the fix. Go to Administration → Licence and paste
the key. It starts with WHL1..
What an unlicensed router still does#
Everything that reads, forever, at no cost. That is a deliberate design decision rather than a trial period: losing sight of your router because a card expired would be a worse product than losing the ability to change it.
| Works without a licence | Needs a licence |
|---|---|
| Sign in, sessions, TOTP, single sign-on | Staging a change |
| Every page and every counter | Committing, and commit-confirm |
| The journal, the commit history and the audit log | Rolling back a revision |
Downloading the configuration, as config.boot or as set commands | Loading or saving a configuration file on the router |
/metrics, and GET on every API route | Installing, updating or removing an app |
wheelhouse-agent plan | The desired-state reconcile loop |
The gate is on the write plane only. /api/auth/*, every GET, the audit log and
/metrics never consult the licence.
That row about downloading the configuration matters more than it looks: it means a lapsed subscription still lets you get your configuration off the box.
Entering the key#
Administration → Licence. The key comes from your purchase; the page's own hint says so. Paste it and save. The agent verifies it, stores it, and asks the licence server about it straight away so the page can show you the server's answer rather than leaving you to guess.
Two panels then describe what the router holds.
This agent — the licence id, the plan, who it is licensed to, the router limit
(unlimited when the limit is zero), the features it carries, the expiry with the days
left, the grace date, and this router's own fingerprint.
Licence server — the server the agent is using, when it last refreshed, what the server said, and the last refresh error if there was one.
How verification works#
A key is WHL1.<kid>.<payload>.<signature>: a signed statement of the plan, the features,
the router limit, the expiry and the grace period. The agent verifies it offline
against an Ed25519 public key compiled into the binary, so a router with no route to the
internet still knows what it holds and keeps working.
While the licence server is reachable the agent refreshes once every 24 hours and
receives a token whose expiry follows the subscription. A router that stays offline keeps
working until the token's expiry plus the grace period the token itself carries — seven
days on the licences the server issues today. During the grace period the state shows as
grace and the page says the date on which configuration changes stop. Revocation reaches
a router on its next refresh, within a day.
The six states the page can show are unlicensed, valid, grace, expired, revoked
and invalid.
The refresh sends four fields — the key, a fingerprint of this installation, the host name
and the agent version — to the licence server at https://license.rhymelikedi.me, and
nothing else ever leaves the router.
The router limit counts distinct installations that have activated the key. A retired router is freed from the licence page.
Removing a key#
Removing the key takes the write plane off the air, is not staged, and has no undo short of
pasting the key back in. The page therefore asks you to type the licence id before it will
do it — the same standard the UI applies to reboot and power off. Where a broken licence
has no readable id, the word to type is remove.
What a licence does not do#
The plans and what each unlocks are on the product site. The prices are not set, and no terms of service or licence agreement exists yet; what ships on the image is a stopgap that says in its own first paragraph that it has not been through legal review. Nothing should be bought until that changes.
See also#
- The first hour — the next step, once you can commit.
- First sign-in — getting to the page in the first place.
- Roles and the three planes — which plane the licence gates.
- API status codes — what a 402 means and where it comes from.
- What the router sends — the four fields in the daily refresh.
- The licence — the terms as they stand.
- If the install goes wrong — every change refused with 402.
Checked against agent/license.go,
ui/src/pages/License.tsx,
agent/main.go,
docs/install.md, docs/privacy.md,
docs/backup-restore.md, PRICING.md.