> ## Documentation Index
> Fetch the complete documentation index at: https://langwatch.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.
# Editions and licensing
> What self-hosted LangWatch gives you for free, what an Enterprise license unlocks, and how to activate one
Self-hosted LangWatch runs the same image that powers LangWatch Cloud. There is no separate "community" build to outgrow and no feature you have to re-deploy to obtain: a license unlocks the Enterprise surface in the software you are already running.
## What you get without a license
Everything the platform stores on your own infrastructure is uncapped. Running unlicensed, you get:
Members, lite members, teams, and projects. Invite your whole organization.
Traces, spans, prompts, evaluations, scenarios and simulations, agents, experiments, datasets, dashboards, custom graphs, and automations.
No visibility window on the data in your own ClickHouse. Retention is yours to configure.
Observability, evaluations, prompt management, agent simulations, the Optimization Studio, and the AI Gateway.
You never need a license just to run LangWatch. A license adds the enterprise capabilities below and a support relationship.
An Enterprise license is priced per seat, so it carries the number of members you bought and the deployment enforces it. Everything else stays uncapped: volume, history, projects, teams, and every experimentation resource. Need more seats? [Talk to us](mailto:enterprise@langwatch.ai) and we reissue the license.
Seats come in two kinds, and which one a person occupies follows from what they can do rather than from a billing switch: someone who can change things holds a **full seat**, someone who can only read what the team produces holds a **lite seat**. Lite seats are counted separately, so read-only reviewers do not consume a full one. See [Seats](/docs/ai-governance/roles-and-permissions#seats).
Volume is bounded by your own hardware, not by us. Self-hosted deployments are not metered and send no usage back to LangWatch.
## What an Enterprise license unlocks
| Capability | Why it is licensed |
| ------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **SSO** (Auth0, Okta, Azure AD, Google, GitHub, GitLab) | Identity federation is the surface enterprises buy. See [SSO configuration](/docs/self-hosting/configuration/sso). |
| **RBAC** with custom roles | Fine-grained permissions beyond the built-in roles. |
| **SCIM** user provisioning | Directory-driven joiner/mover/leaver flows. |
| **Audit logs** | Tamper-evident record of who did what, exportable to your SIEM. |
| **Gateway webhooks** | Signed delivery of spend and budget events from the AI Gateway to your own systems, with retries, replay and a delivery log. This is what platforms build their own usage-based pricing and agent budget controls on. |
| **AI Governance** | Multi-source ingestion, anomaly rules, OCSF and SIEM export, [no-spy mode](/docs/ai-governance/no-spy-mode). |
| **Extended retention** | Multi-class retention policies configured per category. |
| **Support and SLA** | Named contact, response targets, upgrade guidance. |
The Apache 2.0 floor and the Enterprise line are drawn per directory in the repository: the implementations of these capabilities live under [`langwatch/ee/`](https://github.com/langwatch/langwatch/tree/main/langwatch/ee), covered by the [Enterprise license](https://github.com/langwatch/langwatch/blob/main/langwatch/ee/LICENSE.md). See [Open-core licensing](/docs/ai-governance/open-core-licensing) for the file-level map.
## SSO requires a license
Setting the SSO environment variables is not sufficient on its own. A deployment with an identity provider configured but no license runs in **email mode**: the sign-in page offers the email and password form, the identity-provider button is not shown, and SSO sign-in routes are refused.
This is deliberate rather than a failure state, so an unlicensed deployment always has a working door:
* Email sign-up and sign-in stay available.
* **Forgot password** stays available, so anyone whose account was originally created through an identity provider can recover through their inbox. It can only deliver if outbound email is configured; without it the screen says so rather than claiming a link was sent.
Once a license is present **and the configured identity provider actually starts**, the deployment flips to SSO and the email routes close, so no password account can be minted on a licensed install. If `NEXTAUTH_PROVIDER` names a provider LangWatch does not recognise or one whose credentials are missing, the deployment stays in email mode with the email routes open even though it is licensed, so a typo in a provider name cannot lock everyone out.
**Upgrading a deployment that predates this gate, where everyone signs in through SSO.** Before the license gate existed, the SSO environment variables alone were enough, so an unlicensed deployment can have a whole team of identity-provider accounts on it. Those accounts have no password, so the door back in is **Forgot password**, and that needs a working outbound email provider. Before upgrading, either configure SMTP (see [Third-party integrations](/docs/self-hosting/configuration/third-party-integrations)) or set `LANGWATCH_LICENSE_KEY`, which keeps SSO on with no password and no email involved at all.
If you are already in this position, setting `LANGWATCH_LICENSE_KEY` and restarting is the recovery. It needs nothing but the key, as long as the identity provider variables that were already working are still in place: the key licenses SSO, it does not configure it.
## Activating a license
Email [enterprise@langwatch.ai](mailto:enterprise@langwatch.ai) or [talk to sales](https://langwatch.ai/get-a-demo). You receive a signed license key.
In the platform, go to **Settings → License**, paste the key or upload the license file, and choose **Activate License**.
Prefer configuration over a UI step? Set the key as an environment variable instead:
```bash theme={null}
LANGWATCH_LICENSE_KEY=
```
On Helm, the chart takes it inline or from a Secret you already manage:
```yaml theme={null}
app:
license:
key:
secretKeyRef:
name: langwatch-license
key: license
```
Set through configuration, the license entitles the whole instance, so it does not have to be activated again for each organization the deployment hosts. It is also the recovery path for a deployment whose only administrators sign in through SSO: it needs no working login to take effect.
The SSO decision is made once at startup. Plan entitlements apply immediately, but **SSO only turns on after a restart**. The activation confirmation in the UI says so too.
## Expiry
Nothing is switched off on the day a license reaches its end date. Nobody is signed out, no membership is disabled, everyone keeps their access, and the Enterprise capabilities keep working. Losing company-wide login the morning a renewal slips is a worse outcome than serving a former customer for a few days, so the sign-in decision accepts any genuinely issued license regardless of its date, and logs a renewal reminder instead.
The seat count keeps binding. A license we issued is a record of what was bought, so an expired one still covers the seats it sold: an organization holding more members than that is asked to disable the ones who no longer need access, and adding a new member is refused until the license is renewed. Everyone who already has a seat is unaffected.
A license we did not issue is a different thing. Its numbers cannot be trusted, so an unreadable or altered key leaves the deployment on the uncapped open-source baseline, exactly as if it had never held a license.
## Frequently asked
No. Members, lite members, teams, and projects are all uncapped on a self-hosted deployment without a license.
No. The Apache 2.0 floor covers commercial use. A license is for the Enterprise capabilities listed above and for a support relationship.
The SSO gate is deployment-wide: one genuinely licensed organization enables SSO for the whole deployment. Plan entitlements stay per organization.
No. Self-hosted deployments are not metered. [Billable events](/docs/pricing/billable-events) apply to LangWatch Cloud.