Aurea License Integration

Aurea License Portal provides a signed license file for an active Community or paid Aurea organization. An on-premise Aurea environment uses this file to determine which edition, primary limit and validity period apply to the organization.

The license file can be obtained in two equivalent ways: Aurea may download it through a read-only API by using a license download token, or an administrator may download the same file from the portal and upload or paste it into Aurea.

The license file is verified locally by Aurea. A temporary network issue does not invalidate an already downloaded and still valid license file.

The license format, API description and JSON Schema are public by design. Security depends on the license download token and on the private signing key, not on hiding the file format.

Account

Customer account in Aurea License Portal. It groups subscriptions, licensed organizations and portal users.

Organization

Licensed tenant in Aurea, identified by organizationId. The license is assigned to an organization, not to a VM, installation or workspace.

License

Commercial and technical grant for one organization. It defines the edition, validity period and entitlements.

License file

Signed JSON document issued by Aurea License Portal and verified locally by Aurea.

License download token

Secret token used only to download the license file for one organization. It starts with ldt_, is shown only once, and is stored by the portal only as a hash and fingerprint.

Environment type

One of production, staging, test or development. Aurea verifies that the license matches the current organization environment.

{
  "payload": {
    "schemaVersion": 1,
    "licenseRevision": 1,
    "licenseId": "lic_550e8400e29b41d4a716446655440000",
    "licenseType": "subscription",
    "edition": "standard",
    "account": {
      "accountId": "acct_550e8400e29b41d4a716446655440001",
      "name": "Tecna Sp. z o.o."
    },
    "organization": {
      "organizationId": "org_01k2n7pmv9y4z6c5r8f2wq3hda",
      "name": "Tecna",
      "environmentType": "production"
    },
    "validity": {
      "issuedAt": "2026-06-15T12:00:00Z",
      "validFrom": "2026-06-15T12:00:00Z",
      "validUntil": "2026-07-17T12:00:00Z",
      "graceUntil": "2026-07-31T12:00:00Z"
    },
    "entitlements": [
      {
        "code": "users.active",
        "value": 50
      }
    ]
  },
  "signature": {
    "algorithm": "Ed25519",
    "canonicalization": "jcs-rfc8785",
    "keyId": "aurea-license-signing-2026-01",
    "value": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
  }
}

document = parseJson(licenseFile)
payload = document.payload
signature = document.signature

require(payload.schemaVersion == 1)
require(payload.licenseRevision >= 1)
require(signature.algorithm == "Ed25519")
require(signature.canonicalization == "jcs-rfc8785")

canonicalPayload = canonicalizeJcs(payload)
require(verifyEd25519(
  publicKey(signature.keyId),
  canonicalPayload,
  base64urlDecode(signature.value)
))

require(payload.organization.organizationId == currentOrganizationId)
require(payload.organization.environmentType == currentEnvironmentType)
require(now >= payload.validity.validFrom)
if (payload.licenseType == "subscription") {
  require(now < payload.validity.graceUntil)
}

applyEntitlements(payload.entitlements)

The signature covers only the payload object. It does not cover the top-level wrapper or the signature object itself.

Repeated successful downloads of unchanged license data return the exact same signed file, including its revision, license ID and issue time. A change issues a new revision; returning to earlier license data still creates a higher revision.

Before signing and verifying, the payload object is canonicalized using JCS / RFC 8785. This makes the signature independent of whitespace, pretty-printing and JSON object field order.

For schema version 1, the payload uses only JSON types safe for canonicalization: object, array, string and integer values. Floating point numbers are not used in the license payload.

Subscription validity contains all four fields above. Perpetual and Community validity contain only issuedAt and validFrom.

Subscription: before validFrom is NOT_YET_VALID; from validFrom (inclusive) to validUntil (exclusive) is VALID; from validUntil (inclusive) to graceUntil (exclusive) is GRACE; at or after graceUntil is EXPIRED. Perpetual and Community: before validFrom is NOT_YET_VALID, and at or after validFrom is VALID.

Aurea should keep the last successfully verified license file locally. A temporary API error should not remove or invalidate a local license file that is still within its validity or grace period.

{
  "code": "compute.cores",
  "value": 16
}

compute.cores is the maximum CPU or vCPU allocated to the entire running Aurea environment. If multiple valid Processor files are loaded in one environment, the effective limit is the maximum compute.cores value, not their sum. Values 32, 32, and 32 produce an effective limit of 32; values 16 and 32 also produce 32. Each file remains organization-scoped.