KafkaGuard
Get started
FeaturesDocsEnterprisePricingBlogToolsGet started

License Activation

KafkaGuard uses offline RSA-signed license keys — no internet connection or license server required after activation. Your license key is delivered by email after purchase and validates locally on your machine.

Getting a License Key

Self-Serve (Starter and Team)

  1. Go to kafkaguard.com/pricing
  2. Click Start 14-day trial on the Starter or Team plan
  3. Complete the Stripe checkout (credit card required, charged after trial ends)
  4. You'll receive a kg_... license key by email immediately after checkout

Enterprise

Contact sales@kafkaguard.com for an enterprise license with unlimited clusters, SSO, and a dedicated support engineer.

Activating via the CLI

Run kafkaguard license activate with the key from your email:

kafkaguard license activate --key kg_eyJvcmci...

Output:

✅ License activated successfully!

  Organisation : Acme Corp
  Tier         : starter (trial)
  Max clusters : 2
  Expires      : May 25, 2026 (14 days)

Your next scan will automatically use the starter tier. No --tier flag needed.

The license is saved to ~/.kafkaguard/license.json. All subsequent scans automatically use the licensed tier — no --tier flag required.

License Commands

Check Status

kafkaguard license status

Output:

  Organisation : Acme Corp
  Tier         : starter
  Max clusters : 2
  Expires      : May 25, 2026 (28 days remaining)
  Status       : active

Deactivate

kafkaguard license deactivate

Removes the license file from ~/.kafkaguard/license.json. The CLI reverts to Community tier.

Hot-Refresh (Dashboard)

If you have the on-prem dashboard running and receive a renewal key, update without restarting:

kafkaguard license refresh --key kg_eyJvcmci...

This calls the dashboard API to hot-swap the license in-memory and persists the new key to the database. No container restart needed.

License Key Format

License keys start with kg_ followed by a base64-encoded payload and signature separated by a dot:

kg_<base64-payload>.<base64-signature>

The payload contains your organization name, tier, expiry date, and cluster/user limits. The signature is verified locally using KafkaGuard's RSA public key — no network call required.

Trial vs Production License

TrialProduction
Duration14 days1 year (renewable)
ClustersPer tier (Starter: 2, Team: 10)Per tier
UsersUp to 10Up to 10 (paid tiers)
FeaturesFull tier featuresFull tier features
Machine bindingNoNo

Trial and production licenses are identical in format and behavior — the only difference is the expiry date and trial: true flag in the payload.

Tier and Cluster Limits

TierClustersControlsPolicy
Community155finance-iso
StarterUp to 245enterprise-default
TeamUp to 1055finance-iso
EnterpriseUnlimited55finance-iso

The CLI enforces cluster limits when connecting to multiple bootstrap addresses. If you exceed your limit, a warning is shown and the scan proceeds in Community mode for the additional clusters.

Verifying in the Dashboard

Go to Settings in the sidebar. The License panel shows:

  • Organization — your licensed organization name
  • Tier — Community, Starter, Team, or Enterprise
  • Status — Active, Warning (≤30 days to expiry), or Expired
  • Expiry — when your license expires
  • Clusters — how many clusters you're licensed for

License Status Levels

StatusConditionWhat Happens
ActiveMore than 30 days until expiryEverything works normally
Warning30 days or less until expiryAmber banner: "License expires in N days". All features still work.
ExpiredPast expiry dateRed banner: "License expired — read-only mode". New scan ingestion is paused.

Renewing Your License

  1. Purchase a renewal at kafkaguard.com/pricing or contact sales@kafkaguard.com
  2. You'll receive a new kg_... license key by email
  3. Activate the new key:
# CLI only
kafkaguard license activate --key kg_your-new-key-here

# CLI + running dashboard (no restart needed)
kafkaguard license refresh --key kg_your-new-key-here

Community Mode (No License)

Without a license file, KafkaGuard runs in Community mode — free forever:

# Check what tier is active
kafkaguard license status
# → No license file found. Running in Community tier.

Community mode provides:

  • 1 cluster
  • 55 controls (finance-iso policy)
  • All formats: JSON, HTML, PDF, CSV
  • Slack/Teams/Webhook alerts
  • No expiry, no time limit

Troubleshooting

"Invalid license signature"

Your license key may be corrupted. Check:

  • The key starts with kg_
  • No extra spaces or line breaks in the key
  • The key contains exactly one . separator between the payload and signature

"License expired" after renewal

Make sure you ran kafkaguard license activate (or refresh for the dashboard) with the new key after purchase.

License not picked up by CLI

The license file lives at ~/.kafkaguard/license.json. If running as a different user (e.g. in a container), the license needs to be activated under that user or mounted into the container.

Machine Fingerprint

KafkaGuard generates a machine fingerprint from your server's hardware identifiers. You can view your fingerprint in Settings → System.

Fingerprint-Bound vs Unbound Licenses

TypeBehavior
Unbound (recommended)Works on any machine. Recommended for Docker deployments.
Fingerprint-boundLocked to one machine. Breaks if Docker containers are recreated.

⚠️ If you use Docker: Always request an unbound license from kafkaguard.com/pricing or sales@kafkaguard.com. Recreating containers (e.g. docker compose down && up) changes the fingerprint and will invalidate a bound license.

Support