Skip to main content
Self-hosted LangWatch runs the same image that powers LangWatch Cloud. There is no separate “community” build to outgrow and no feature you have to re-deploy to obtain: a license unlocks the Enterprise surface in the software you are already running.

​
What you get without a license

Everything the platform stores on your own infrastructure is uncapped. Running unlicensed, you get:

Unlimited people

Members, lite members, teams, and projects. Invite your whole organization.

Unlimited work

Traces, spans, prompts, evaluations, scenarios and simulations, agents, experiments, datasets, dashboards, custom graphs, and automations.

Your full history

No visibility window on the data in your own ClickHouse. Retention is yours to configure.

The whole product surface

Observability, evaluations, prompt management, agent simulations, the Optimization Studio, and the AI Gateway.
You never need a license just to run LangWatch. A license adds the enterprise capabilities below and a support relationship.
An Enterprise license is priced per seat, so it carries the number of members you bought and the deployment enforces it. Everything else stays uncapped: volume, history, projects, teams, and every experimentation resource. Need more seats? Talk to us and we reissue the license.Seats come in two kinds, and which one a person occupies follows from what they can do rather than from a billing switch: someone who can change things holds a full seat, someone who can only read what the team produces holds a lite seat. Lite seats are counted separately, so read-only reviewers do not consume a full one. See Seats.
Volume is bounded by your own hardware, not by us. Self-hosted deployments are not metered and send no usage back to LangWatch.

​
What an Enterprise license unlocks

The Apache 2.0 floor and the Enterprise line are drawn per directory in the repository: the implementations of these capabilities live under langwatch/ee/, covered by the Enterprise license. See Open-core licensing for the file-level map.

​
SSO requires a license

Setting the SSO environment variables is not sufficient on its own. A deployment with an identity provider configured but no license runs in email mode: the sign-in page offers the email and password form, the identity-provider button is not shown, and SSO sign-in routes are refused. This is deliberate rather than a failure state, so an unlicensed deployment always has a working door:
  • Email sign-up and sign-in stay available.
  • Forgot password stays available, so anyone whose account was originally created through an identity provider can recover through their inbox. It can only deliver if outbound email is configured; without it the screen says so rather than claiming a link was sent.
Once a license is present and the configured identity provider actually starts, the deployment flips to SSO and the email routes close, so no password account can be minted on a licensed install. If NEXTAUTH_PROVIDER names a provider LangWatch does not recognise or one whose credentials are missing, the deployment stays in email mode with the email routes open even though it is licensed, so a typo in a provider name cannot lock everyone out.
Upgrading a deployment that predates this gate, where everyone signs in through SSO. Before the license gate existed, the SSO environment variables alone were enough, so an unlicensed deployment can have a whole team of identity-provider accounts on it. Those accounts have no password, so the door back in is Forgot password, and that needs a working outbound email provider. Before upgrading, either configure SMTP (see Third-party integrations) or set LANGWATCH_LICENSE_KEY, which keeps SSO on with no password and no email involved at all.If you are already in this position, setting LANGWATCH_LICENSE_KEY and restarting is the recovery. It needs nothing but the key, as long as the identity provider variables that were already working are still in place: the key licenses SSO, it does not configure it.

​
Activating a license

1

Get a license

Email enterprise@langwatch.ai or talk to sales. You receive a signed license key.
2

Activate it

In the platform, go to Settings → License, paste the key or upload the license file, and choose Activate License.Prefer configuration over a UI step? Set the key as an environment variable instead:
On Helm, the chart takes it inline or from a Secret you already manage:
Set through configuration, the license entitles the whole instance, so it does not have to be activated again for each organization the deployment hosts. It is also the recovery path for a deployment whose only administrators sign in through SSO: it needs no working login to take effect.
3

Restart the deployment

The SSO decision is made once at startup. Plan entitlements apply immediately, but SSO only turns on after a restart. The activation confirmation in the UI says so too.

​
Expiry

Nothing is switched off on the day a license reaches its end date. Nobody is signed out, no membership is disabled, everyone keeps their access, and the Enterprise capabilities keep working. Losing company-wide login the morning a renewal slips is a worse outcome than serving a former customer for a few days, so the sign-in decision accepts any genuinely issued license regardless of its date, and logs a renewal reminder instead. The seat count keeps binding. A license we issued is a record of what was bought, so an expired one still covers the seats it sold: an organization holding more members than that is asked to disable the ones who no longer need access, and adding a new member is refused until the license is renewed. Everyone who already has a seat is unaffected. A license we did not issue is a different thing. Its numbers cannot be trusted, so an unreadable or altered key leaves the deployment on the uncapped open-source baseline, exactly as if it had never held a license.

​
Frequently asked

No. Members, lite members, teams, and projects are all uncapped on a self-hosted deployment without a license.
No. The Apache 2.0 floor covers commercial use. A license is for the Enterprise capabilities listed above and for a support relationship.
The SSO gate is deployment-wide: one genuinely licensed organization enables SSO for the whole deployment. Plan entitlements stay per organization.
No. Self-hosted deployments are not metered. Billable events apply to LangWatch Cloud.