> For the complete documentation index, see [llms.txt](https://docs.exavault.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.exavault.com/administration/license-keys.md).

# License Keys

Every ExaVault installation, free or paid, registers and regularly updates a license key file. The license key tells the appliance which paid features have been provisioned, and a valid license key file is required for both free and paid usage.

Starting with version 18, the ExaVault Appliance Manager checks for an updated license approximately once per hour. Each successful check-in returns a short-lived license that remains valid for 48 hours. A temporary failure therefore does not immediately interrupt the appliance, but the problem must be corrected before the active license expires.

When 36 hours or fewer remain, administrators see a warning in the web interface and the Appliance Manager. ExaVault also attempts to email administrators about the expiration every 12 hours. Email warnings require a working [SMTP configuration](/administration/sending-email.md).

If the license expires, the main ExaVault application restricts access until a valid license is restored. The Appliance Manager remains reachable so that you can investigate connectivity and restore licensing.

If your paid account goes past due, the appliance automatically reactivates within an hour after the payment is received.

## Firewall Requirements

The license key update mechanism requires unrestricted outbound access on port 443 (HTTPS). This is a mandatory requirement for using ExaVault.

ExaVault does not support a deployment that blocks outbound requests to the licensing service, regardless of whether the installation is free or paid.

If a license warning appears, confirm that the appliance can resolve public DNS and make outbound HTTPS connections. Check the `admin-dashboard` files under `/data/exavault/logs/` for license check-in errors; [Logging](/administration/logging.md) explains the service-log filenames and date handling.

## IP Address Registration and Restrictions

To prevent abuse of our licensing system, each ExaVault installation must be associated with a single IP address at any given time.

Do not proxy outbound traffic through systems that could generate multiple source IP addresses. If you use a proxy, it must not alter the source IP address of license key requests.

### IP Address Changes

We allow legitimate IP address changes and process them automatically. To distinguish between real changes and license sharing attempts, only one IP address change per week is allowed. More than one change in a week is flagged as a potential license violation.

We are not aware of any legitimate need for an appliance to change IP addresses more frequently than once per week. If your setup requires this, contact our support team.

### Cloud Provider Considerations

When deploying ExaVault on a cloud provider, configure the appliance with a static (elastic) IP address. This prevents IP changes caused by instance resizes, stops, and restarts.

## Information Sent During License Check-In

License check-ins include configuration and usage information used to validate the license and help diagnose appliance health, capacity, and feature usage. ExaVault sends the following categories:

| Category             | Information Included                                                                                   |
| -------------------- | ------------------------------------------------------------------------------------------------------ |
| Appliance identity   | Device ID and the source IP address observed by the licensing service                                  |
| Software             | Appliance and virtual-machine image versions, plus active service names and versions                   |
| System configuration | Configured domain and IP address, SMTP configuration, and Syslog configuration                         |
| FTP configuration    | FTP IP address, passive port range, and the filesystem paths used for certificate configuration        |
| Usage and capacity   | Active-user count, file-activity statistics, and total, used, and available disk space                 |
| Environment          | CPU architecture, detected cloud provider, and cloud account or subscription identifier when available |

The check-in does not include file contents, passwords, Twilio configuration, certificate contents, or private-key contents. SMTP authentication credentials are excluded. Certificate and key paths may be reported, but the files themselves are not transmitted.