A self-hosted ORC8R server runs in demo mode until you give it a license key. Demo mode is the whole product with fixed capacity ceilings on it: nothing is time-limited, nothing is watermarked, and no one — not even the zone owner — can raise the ceilings from inside the product. A monthly license, bought on orc8r.com, replaces the ceilings with your plan's limits. This page covers the ceilings, how to enter a key, what happens if orc8r.com is unreachable, how to move a license to another cluster, and exactly what this server sends home.

The demo ceilings

Limit	Demo value
Projects per organization	3
Pools per project	3
Nodes per pool	3
Nodes in the zone	25

These apply to every organization in the zone, including the system organization the platform uses for its own pools and apps. The values are sized so a fresh install fits with room to evaluate.

Nothing else is capped. In particular there is no ceiling on user accounts, and there is no limit on how long you run in demo mode.

While the zone is unlicensed, a banner on the zone's pages names the ceilings, and any create that would cross one is refused with a message naming the limit and linking to the purchase page. Attempts to raise an organization's limits are refused too — that is what "pinned" means here. Activating a license hands the organization limits back to you and pins the zone's node ceiling to your plan's cap instead.

Buying a license

Licenses are sold at orc8r.com/buy. Checkout is one screen — email and card, no account required first — and it hands you a key that looks like ORC-4ANQD-EYS49-534PK-C6YZF. The key is also emailed to you and can be recovered later from the orc8r.com console.

One license entitles one zone on one cluster at a time.

Entering the key

1. Open your zone and go to the License tab.
2. Paste the key into License key and click Save.

The server checks the key's shape locally first, so a typo is caught immediately without a network call. It then calls orc8r.com to activate. On success the tab shows Licensed, the plan name, and the zone's new node ceiling, and the ceilings lift within a few seconds.

The tab also has a Test connection button. It only checks that this server can reach the orc8r.com license API — it activates nothing and cannot disturb an existing license.

Entering a different key replaces the current license. Clearing the field (submit a single -) removes the license and returns the zone to demo mode.

The tab never shows the whole key back to you. It shows the first and last groups — ORC-4ANQD-…-C6YZF — which is enough to tell which key is installed. The key is sealed in the server's secret store and is redacted from logs and diagnostics.

Leases, renewal, and grace

Activation does not give the server a permanent entitlement. It gives it a lease: a short, signed grant naming the plan and its limits. The server verifies the signature offline against a public key compiled into the binary, so checking that the lease is valid never needs the network.

• A lease is valid for 72 hours.
• The server renews it every 24 hours (with a little jitter so clusters do not all renew at once), and sooner if the lease is within an hour of expiring. Exactly one member of the cluster runs the renewal timer.
• A failed renewal is retried with backoff, between five minutes and an hour apart. While the current lease is still valid you see nothing: three renewal attempts fit inside one lease.

If renewals keep failing until the lease expires, the zone enters grace:

• Grace lasts 14 days, measured from the lease's expiry.
• During grace the zone keeps its licensed limits. Nothing is blocked and nothing is switched off.
• A banner names the reason and the exact date the demo ceilings would return, and the zone and organization owners are notified in the app and by email.
• Any successful renewal ends grace immediately and returns the zone to Licensed.

If grace runs out, the demo ceilings come back. That is the full outage budget: 72 hours of silent lease validity plus 14 days of visible grace — roughly 17 days before an unreachable orc8r.com costs you anything.

And when it does cost you something, it costs you growth and nothing else:

No license state ever stops, migrates, or refuses to relaunch a running workload. Degradation blocks new creates, enrollments, and scale-ups past a ceiling. Everything already running keeps running, restarts included. Resources that are over a ceiling when the zone degrades are grandfathered: visible, operable, not extendable.

Grace is entered the same way for every reason the lease could not be renewed — the network, a lapsed subscription, or another cluster having taken the license over — and the banner says which one it was.

If the subscription is the problem, fixing payment on orc8r.com is enough: the next renewal succeeds and the zone recovers on its own. You can also re-submit the key on the License tab to recover immediately.

Moving a license to another cluster

Activation always wins. If you activate the same key on a second cluster, that cluster gets the lease and the first one learns about it on its next renewal — the tab shows Grace, with "taken over by another instance" and the other cluster's hostname as the reason, and the usual 14 days to sort it out.

This is deliberate, and it is what makes migration and disaster recovery self-service:

• Migrating to new hardware: activate the key on the new cluster. The old one degrades on its own schedule; there is nothing to release by hand, and nothing to wait for if the old cluster is already dead.
• Cold-standby DR: keep the key, and activate it on the standby when you fail over. The standby is licensed immediately.
• Do not run both at once. Two live clusters holding one key will take the license from each other in turn, and each takeover notifies the license owners. Three or more takeovers in seven days flags the license on orc8r.com and triggers a key-sharing warning.

A cluster keeps its identity across member replacement, restarts, and backup restores, so none of those look like a takeover. Only genuinely concurrent copies of a cluster collide.

What this server sends to orc8r.com

This is the complete list. There are two requests, both to https://orc8r.com, and this server makes no other calls home of any kind.

When you activate a key — POST /api/license/activate, once per submission:

• the license key you pasted;
• this cluster's instance fingerprint (a random identifier minted at cluster bootstrap; it is not derived from your hardware);
• this member's hostname;
• the ORC8R server version.

When the lease is renewed — POST /api/license/renew, every 24 hours, plus retries on failure:

• the license key;
• the instance fingerprint;
• the identifier of the lease being renewed.

That is everything. No project, pool, node, app, or user data is sent. No usage counts, no metrics, no logs, no telemetry. The hostname and version are sent so that a takeover notification can name both clusters in a way you will recognize.

The Test connection button additionally sends an empty request to the activation URL to check that it is reachable. It carries no key and no fingerprint.

If your deployment must not talk to orc8r.com at all, run in demo mode: it makes no outbound calls, because there is no key to activate.

Related pages

• Organizations — where the project, pool, and node limits are shown.
• Pools — requesting and scaling nodes against those limits.
• FAQ — quick answers to common questions.