Get a license
ReadyStart free at 50 users, no card — a one-year license you pull again in seconds. Paid is $2/user/month from 51–250 seats and a flat monthly band from 251–1,000 ($600 to 500 users, $800 to 750, $950 to 1,000 — the per-user rate falls as you grow), billed monthly or annually; the license lasts as long as you’ve paid for, and your running deployment never phones home to Ydentifi — not to renew, not ever. Above 1,000 seats the license is flat and independent of user count; contact us directly, as you would for an SLA, a multi-region deployment, or if you would like us to deploy it for you.
Who this is for: whoever is standing up a new deployment, or an operator who wants to know exactly what the running server sends to Ydentifi (nothing) and how the next license file is obtained. For day-2 details, see Operate & maintain.
Free or paid#
- 50 users, with no limit on relying parties within your own business group.
- The full product: every factor tier and every RPC. Free is limited in capacity, not in features.
- Open to every licensee type in every served country. No card and no sales call: run
ydfi register,ydfi pullandydfi license apply, and the deployment is licensed in minutes.
- A flat rate to 250 seats: 120 seats is $240 a month, with no sliding scale to negotiate.
- From 251 seats the bill is a flat monthly band ($600 to 500 users, $800 to 750, $950 to 1,000), so the rate per user falls as you grow.
- Monthly or annual billing; annual prepay is 10 months for 12.
- Tell Ydentifi the seats you need at business@ydentifi.io. Once they are set on your account,
ydfi pulldownloads the paid license.
Above 1,000 seats the license is flat and independent of user count, and is not a self-serve price. The same applies if you need an SLA or a multi-region deployment, or would like us to deploy it for you. Contact Ydentifi directly; the published price bands are on Pricing. Air-gapped operation is not an add-on: every tier runs fully offline (see below).
Getting a license#
Register once, by email
Registration creates your licensing account. Ydentifi emails an activation code from noreply@licenses.ydentifi.io; you enter it at the prompt, never as a flag. The code is valid for 10 minutes, during which you have up to five attempts. If the address already has an account, you receive a notice instead of a code.
The licensee details are required because every license names its holder. --licensee-type is one of individual, sole-trader, company, non-profit or public-body. An individual gives no identifier; every other type gives a scheme and a value (VAT number, national registration, D-U-N-S or LEI, depending on the type; --licensee-id-label names the identifier when the scheme is other).
Once the code is accepted, the API key is stored on this machine, readable only by you: in $XDG_CONFIG_HOME/ydentifi/licensing.key, or the operating system’s configuration directory when XDG_CONFIG_HOME is unset (on macOS, ~/Library/Application Support/ydentifi/licensing.key). YDFI_LICENSING_CREDENTIAL_PATH stores it elsewhere, and YDFI_LICENSING_API_KEY supplies it from the environment. The key is never passed as a flag.
Tell us the seats
Contact Ydentifi at business@ydentifi.io with the address you registered. We set the seats and the paid-to date on your account. Nothing changes on your side until you download the next license.
Download, install, check
ydfi pull downloads the license your account is entitled to (the free allowance, or the seats and term set for a paid account), verifies it, and saves it to license.jwt; --output chooses another file, and --output - writes it to standard output. ydfi license apply installs it at the path your server reads, given by --output-path or by YDFI_SERVER_LICENSE_PATH, after checking its signature and expiry. A running server checks for a new license about once a minute, and a stopped one loads it at startup; a license for a different customer is loaded only when the server restarts. If the server runs in a container, mount the directory that holds the license, never the license file on its own: apply replaces the file, and a container with only the file mounted keeps reading the old license.
ydfi license status shows, from the running server, the license it has in force, a new one it is holding back and why, the seat-cap state it enforces, and live seat usage. ydfi license describe shows what a license file says, and ydfi deployment preview-license --db <uri> --license-file <file> checks a new license against the users and seats a deployment already has before you install it.
What a license contains#
A license is a signed file of about 19 KB. It names its holder (legal name, licensee type, identifier, country and contact email) and states the seat count, the issue date and the expiry date. It carries a hybrid signature, Ed25519 paired with ML-DSA-65, that chains to the Ydentifi root built into every Ydentifi binary. The server verifies it at startup and on every reload, offline, against that root.
Expiry and renewal#
A license runs for a year, or to the date a paid account has paid to if that is sooner. Renewal is a file you download and install; your server never makes a call to obtain it.
| Stage | What the deployment does |
|---|---|
| Active | serves normally |
| Renewal due | from 7 days before expiry: serves normally and logs warnings |
| Grace period | for 30 days after expiry: serves normally and logs warnings |
| After the grace period | refuses requests until a new license is installed; the admin plane keeps working |
There is no renewal call and no renew command: the deployment has no code path that contacts Ydentifi. To renew, run ydfi pull again and install the result with ydfi license apply, as you installed the first. A license can be downloaded as often as you need, within an hourly limit. For a paid account, the paid-to date is extended by Ydentifi first.
If the next file is late (an expired card, a billing question, a holiday), the deployment keeps serving for the 30 days of the grace period while you resolve it. Because nothing is fetched over the network, there is nothing that can fail to fetch.
Renewing with fewer seats
Your relying parties reserve seats out of the license’s total. If the new license has fewer seats than they reserve, check before you install it: ydfi deployment preview-license --db <uri> --license-file license.jwt says whether the deployment fits and what to cut. A running server does not install a license that would stop it. It keeps the license in force and logs what the new one allows, what the relying parties reserve and hold, and what to cut; ydfi license status shows the new license as waiting, and why. Cut reservations with ydfi admin update-rp --rp-id <rp> --max-users <seats> --reason "…": a reservation can always be cut, down to the users the relying party holds, even while the total is over. Once they fit, the server loads the new license within about a minute, with nothing more to install. A server started with such a license starts, but serves no applications until the reservations fit; its admin plane works, so you can make the cuts.
Several copies on one database
When several copies of the server share one database, each reads its license file on its own. For a minute or two after a renewal they can disagree about the seat limit, and some copies may refuse service. We recommend renewing with a short stop: stop every copy, install the new license for all of them, then start them again.
Staging and test deployments#
One license covers all your production deployments: the users on all of them together count against its one seat allowance. Use the same license on your staging and test deployments too; their test users do not count against your seats. Each deployment checks the license against its own users, so keeping the total within the allowance across production deployments is up to you.
Your API key#
The API key is your login to the licensing service. It is used by ydfi pull and ydfi rotate, never by your server. ydfi rotate replaces it; the previous key is revoked as soon as the new one is issued, and Ydentifi emails the account to say so. A lost key cannot be recovered from your machine or by email. Contact licensing@ydentifi.io and the Ydentifi support team can issue a replacement.
Countries#
Licenses are issued to 180 countries and territories: all of Europe except Russia and Belarus, the Americas except Cuba, Venezuela, Nicaragua and Haiti, and much of Asia, Africa and Oceania. ydfi license countries lists them; pass one of its codes as --country when you register. A license already issued keeps working wherever it is installed.
Registration is limited to 5 requests an hour and 20 a day from one network, which is generous for an office behind one address.
What phones home, and what never does#
Nothing. Your running deployment makes no calls to Ydentifi: not at startup, not during operation, not to renew.
There is no renewal call, no heartbeat, no check-in and no telemetry; the code path does not exist. The only commands that contact Ydentifi are ydfi register, ydfi pull and ydfi rotate, which you run from a terminal of your choice, over verified TLS to licensing.ydentifi.io:443. They are commands you run, not connections out of your server.
Everything a user does stays within your deployment too. An enrolled device only ever talks to the deployment it enrolled against, with no call to Ydentifi in the loop, the same property as the rest of the ceremony (see no APN/FCM in the auth path). If Ydentifi were unavailable, every challenge, signature and approval would keep working until the grace period after the current license’s expiry.
A fully air-gapped deployment needs nothing extra, on any tier: there is no renewal call to fail. Download the license on a connected machine, carry the file across, and install it; the server runs on it until it expires, and you install the next one the same way.