Licensing Architecture, Heartbeats & Offline Tokens

Understanding platform licensing models, automated user seat counting, and cryptographic offline token verification.

---

1. Licensing Modes

The platform supports two distinct licensing models depending on your infrastructure:

A. Online Connected Nodes (Heartbeat Protocol)

• The nexus_agent daemon transmits an encrypted telemetry heartbeat every 60 seconds to License Hub (https://deznot.com/api/v1/telemetry/heartbeat).
• Transmits health status, active user count, and installed module versions.
• Features a built-in 72-Hour Grace Period: if network connectivity is temporarily disrupted, the node remains fully operational without service interruption.

B. Air-Gapped Offline Licenses

• Cryptographically signed ECDSA P-256 JWT license token signed by the platform Krypton HSM.
• Encodes licensed user limits (seats), enabled feature modules, and expiration date (up to 1 year).
• Requires zero external network connectivity.

---

2. User Seat Allocation & Usage Metrics

• Seat Calculation: nexus_agent queries the local database to determine the number of registered active user accounts.
• Quota Matching: Usage is checked against the licensed subscription capacity (subscription.quantity).
• Capacity Warnings: If team members exceed the purchased seat quota, organization administrators are notified to add seats in Billing & Subscriptions.

---

3. Renewing & Updating Node Licenses

Online Nodes:

Seat count updates, renewals, or plan changes made in the Client Portal apply instantly on the server during the next 60-second heartbeat cycle.

Offline Nodes:

1. Visit your deployment in Client Portal.
2. Click Renew Offline License Token.
3. Copy the signed JWT token and update OFFLINE_LICENSE_JWT in your server's .env file:

   OFFLINE_LICENSE_JWT="eyJhbGciOiJFUzI1Ni..."
   

4. Restart the agent container:

   docker compose restart nexus_agent