License

Every 10x Engine runs against a license token (a signed JWT) that the engine verifies locally at startup. The token is bound to one environment and carries the licensed node count. Most deployments need nothing beyond the token. Air-gapped sites that cannot reach prometheus.log10x.com add the License Receiver, a small service that counts nodes locally for offline billing.

Pricing is per node, with unlimited log volume and every product included. The ladder, trial terms, and node-counting rules live on the pricing page and the pricing FAQ. This page covers the mechanism, not the numbers.

The license token

The token is an ES256-signed JWT minted by the Log10x backend and verified by the engine against an embedded public key. No online check runs at engine startup. The token carries the environment ID, the licensed node count, and an expiry.

Property	Value
Format	ES256 JWT, signed by KMS
Bound to	one environment (one token per environment)
Carries	node count, expiry, permission level
Where it lives	helm value `log10xLicenseJwt`, mounted at `TENX_LICENSE_FILE` in the pod
Verified	locally by the engine, offline

Getting a token

Trial. A 30-day token is issued from your account on first download. The clock is anchored to your signup date and does not reset on re-download. The trial is honor-system: nothing hard-blocks at the edge during it.
MCP. The MCP install advisor mints a token from your signed-in session and writes it straight into the helm values it emits. When no one is signed in, it mints a 14-day anonymous demo token so an install plan still works.
Paid. Token terms follow your subscription, whether it came through Stripe or AWS Marketplace.

Expiry and enforcement

The token's expiry is enforced, with a few hours' leeway for clock skew and renewal. Node-count overage against the tier is not hard-enforced at the edge: the engine keeps running, and overage is reconciled against the plan. Renewal re-issues the token. For connected deployments this is automatic; air-gapped sites renew as part of the periodic report exchange below.

Connected vs air-gapped

Reaches `prometheus.log10x.com`?	Usage tracking	License Receiver
Yes	automatic from the metrics already sent	not needed
No (air-gapped)	local, via the Receiver	required

Engines that already send metrics to prometheus.log10x.com are counted there, and need nothing else. The rest of this page is for air-gapped sites.

License Receiver (air-gapped only)

The Receiver accepts the same Prometheus Remote Write payload engines already send, keeps only the billing-relevant series, and produces a P90 node-count report for periodic reconciliation. It never sees log content, only node heartbeats and counts.

Point engines at the Receiver instead of the hosted endpoint:

export TENX_BACKEND_ENDPOINT=http://license-receiver:8080/

No engine changes are needed; only the endpoint differs.

Deploy

DockerKubernetes

docker run -d \
  --name license-receiver \
  -p 8080:8080 \
  -v license-data:/data \
  -e STORE_TYPE=sqlite \
  -e SQLITE_PATH=/data/license.db \
  log10x/license-receiver:latest

apiVersion: apps/v1
kind: Deployment
metadata:
  name: license-receiver
spec:
  replicas: 1
  selector:
    matchLabels: { app: license-receiver }
  template:
    metadata:
      labels: { app: license-receiver }
    spec:
      containers:
      - name: license-receiver
        image: log10x/license-receiver:latest
        ports: [{ containerPort: 8080 }]
        env:
        - { name: STORE_TYPE, value: sqlite }
        - { name: SQLITE_PATH, value: /data/license.db }
        volumeMounts: [{ name: data, mountPath: /data }]
        livenessProbe: { httpGet: { path: /health, port: 8080 } }
      volumes:
      - name: data
        persistentVolumeClaim: { claimName: license-receiver-pvc }

Configure

Variable	Default	Description
`LICENSE_RECEIVER_LISTEN`	`:8080`	HTTP listen address
`STORE_TYPE`	`sqlite`	`sqlite` or `postgres`
`SQLITE_PATH`	`/data/license.db`	SQLite database path
`POSTGRES_URL`	none	PostgreSQL connection string
`CLEANUP_RETENTION`	`2160h`	Data retention (90 days)

SQLite suits single-node and air-gapped use; PostgreSQL is for HA or large scale. Full endpoint reference: License API.

Reconcile

Generate a P90 report and send it to your account contact at each billing period:

curl -o usage-report.json \
  "http://license-receiver:8080/api/v1/report?customer_id=acme-corp&period=90"

P90 is the 90th percentile of distinct daily node counts over the period, so short spikes do not move the number. Reports are HMAC-signed for tamper-evidence.

Troubleshooting

Engine will not start

Check the license token is mounted at TENX_LICENSE_FILE and has not expired. Re-mint from your account or via the MCP install advisor.

Receiver shows zero nodes

Confirm engines point at TENX_BACKEND_ENDPOINT=http://license-receiver:8080/ and can reach it on port 8080. Heartbeat series must carry a node identifier label.

FAQ

Do I need the License Receiver?

Only if engines cannot reach prometheus.log10x.com. Connected deployments are counted automatically.

What is the difference between the token and the Receiver?

The token is the credential every engine verifies to run. The Receiver is an air-gapped accessory that counts nodes for offline billing. They are separate.

What data leaves an air-gapped site?

Only the P90 report you export and send manually. The Receiver keeps everything else local and never sees log content.

Does my license hard-block if I go over my node tier?

No. The engine keeps running; overage is reconciled against the plan. The token's expiry, however, is enforced.