---
icon: material/license
title: "License"
description: "How the 10x license works: a signed token every engine verifies locally, with a built-in evaluation license when none is configured"
---

Every 10x Engine runs against a **license token** (a signed JWT) that the
engine verifies locally at startup. The token is bound to one environment
and carries the licensed node count. Verification is offline and local
verification is the only gate: no call to log10x can stop a pipeline, and
an engine with no license configured still runs, on the built-in
evaluation license below.

Pricing is per node, with unlimited log volume and every product included.
The ladder, trial terms, and node-counting rules live on the
[pricing page](https://log10x.com/pricing){target="_blank"} and the
[pricing FAQ](../faq/pricing/). This page covers the mechanism, not the numbers.

## No license: the evaluation license

An engine with no token configured synthesizes its own **evaluation
license** at startup: the full product for **30 days** from process start,
up to **10 nodes**, running air-gapped. Nothing is downloaded, no account
exists, and the engine makes no outbound call at all, so an evaluation can
be packet-captured and found silent.

The engine logs two lines at startup naming the ceiling and this page.
Buying a license removes the ceiling; it does not unlock the binary.

## The license token

The token is an ES256-signed JWT minted by the Log10x backend and verified
by the engine against an embedded public key. The token carries the
environment ID, the licensed node count, and an expiry.

Verification is local and complete: it proves signature, expiry, and shape
on its own. When a [service endpoint](../run/bootstrap/) is explicitly
configured (none is by default) and the engine is not
[air-gapped](../faq/security/deployment/), it also makes one best-effort
enrichment call at startup; an endpoint that cannot be reached produces a
warning and the engine runs.

| Property | Value |
|----------|-------|
| Format | ES256 JWT, signed by KMS |
| Bound to | one environment (one token per environment) |
| Carries | node count, expiry, permission level |
| Where it lives | helm value `log10xLicenseJwt`, mounted at `TENX_LICENSE_FILE` in the pod |
| Verified | locally by the engine, offline |

### Getting a token

- **Evaluation.** No token. Download, run, and the engine evaluates on its
  built-in license.
- **MCP.** The [MCP install advisor](../apps/mcp/) mints a token from your
  signed-in session and writes it straight into the helm values it emits.
- **Paid.** Token terms follow your subscription, whether it came through
  [Stripe](https://log10x.com/pricing){target="_blank"} or
  [AWS Marketplace](https://aws.amazon.com/marketplace/pp/prodview-syuhwof656u52){target="_blank"}.

### Expiry and enforcement

The token's expiry is enforced, with a few hours' leeway for clock skew and
renewal. The engine keeps running past the licensed node count, and overage is
reconciled against the plan.
Node counts are licensed terms reconciled with your account, not metered by
the engine; a default deployment reports nothing to log10x.

Renewal re-issues the token. Replace the mounted file or helm value; no
engine restart ordering matters beyond picking up the new file.

## Troubleshooting

??? tenx-troubleshoot "Engine logs an evaluation-license warning"
    Expected whenever no token is configured. Mount one at
    `TENX_LICENSE_FILE` or set `licenseKey` to silence it.

??? tenx-troubleshoot "Engine will not start"
    A configured token that fails verification (expired, malformed, wrong
    key) stops the engine. Check expiry and re-mint; or remove the token to
    fall back to the evaluation license.

## FAQ

??? question "A licence request is failing. Is it me or log10x?"
    [status.log10x.com](https://status.log10x.com){target="_blank"} publishes
    the health of the endpoints an install or purchase needs. A running engine
    verifies its licence locally and never calls them, so a green board with a
    failing request points at credentials or network egress on your side.

??? question "Does my license hard-block if I go over my node tier?"
    No. The engine keeps running; overage is reconciled against the plan.
    The token's expiry, however, is enforced.

??? question "What happens when the 30-day evaluation expires?"
    The evaluation window is measured from process start. A restart begins a
    new window; the ceiling that matters is the 10-node scope. Production
    rollouts past that need a token.