Activation Model

Enterprise licensing uses a KMS-style activation model.

Activation Flow

1. Customer purchases enterprise license on getarcan.dev
2. Site generates activation key: arc_ent_<32-char-random>
3. Customer runs: arcan activate arc_ent_xxxxxxxxxxxx
   a. CLI computes org fingerprint: SHA-256(machine_id + org_name)
   b. CLI calls POST /v1/activate with key + fingerprint
   c. Registry validates key, binds to fingerprint
   d. Registry returns activation token (JWT, 7-day expiry)
   e. CLI stores token at ~/.arcan/license.json
4. Enterprise plugin installs send activation token in Authorization header
5. Periodic heartbeat every 7 days renews the token
   a. If online: POST /v1/heartbeat → new token
   b. If offline: 30-day grace period before enterprise plugins stop loading
6. Grace period expired: enterprise plugins refuse to start, clear error message
   "Enterprise license expired. Reconnect to renew: arcan activate --refresh"

Activation Record

Stored in the registry database:

{
    "activation_id": "uuid",
    "license_key_hash": "sha256(arc_ent_xxx)",
    "org_fingerprint": "sha256(machine_id + org_name)",
    "activated_at": "2026-04-01T00:00:00Z",
    "last_heartbeat": "2026-04-01T12:00:00Z",
    "expires_at": "2027-04-01T00:00:00Z",
    "tier": "enterprise",
    "max_seats": 5,
    "features": ["ssh-proxy", "kmip", "break-glass", "mcp-server"]
}

License File

Stored locally at ~/.arcan/license.json:

{
    "activation_id": "uuid",
    "token": "eyJ...",
    "org_fingerprint": "sha256...",
    "activated_at": "2026-04-01T00:00:00Z",
    "token_expires_at": "2026-04-08T00:00:00Z",
    "license_expires_at": "2027-04-01T00:00:00Z",
    "features": ["ssh-proxy", "kmip", "break-glass", "mcp-server"],
    "grace_period_days": 30
}