Online License Activation

Section: Licensing | Article 12
Audience: IT Administrators
Last Updated: 2026-04-07

---

Overview

RP-PAM requires a valid license to operate. This article covers online license activation, where your RP-PAM server communicates with the Ravenphyre License Verification Service (LVS) over HTTPS to validate and periodically check in your license.

If your RP-PAM server cannot reach the internet, see Offline License Activation instead.

---

What You Receive from Ravenphyre

When you purchase an RP-PAM license, Ravenphyre sends you a welcome email containing:

Item	Description
License file (.lic)	A signed file containing your organisation name, tier, user limit, expiry date, and enabled features
License key	A human-readable key string in the format RPPAM-XXXX-XXXX-XXXX-XXXX-XXXX (can be used instead of the .lic file)
Support contact	Email support@ravenphyre.net for license downloads, usage queries, and renewal management
Registry credentials	Username and token for registry.ravenphyre.net (used for pulling container images and Helm charts)
Download credentials	Username and token for downloads.ravenphyre.net (used for downloading MSI, deb, and rpm packages)

Tip: If you cannot locate your welcome email, contact support@ravenphyre.net.

---

Activation Methods

You can activate your license using any of the following methods:

1. Setup Wizard (during first-time setup)
2. Web Portal (after setup is complete)
3. REST API (PowerShell or curl)

---

Method 1 — Setup Wizard

During the Setup Wizard (Step 4), you are prompted to import your license:

License file path [or paste key]: /path/to/rppam-license.lic

Or paste the license key directly:

License file path [or paste key]: RPPAM-XXXX-XXXX-XXXX-XXXX-XXXX

The wizard validates the license against the LVS and activates it automatically. No further action is needed.

---

Method 2 — Web Portal

1. Log in to the RP-PAM web portal at https://<your-server>:7101.
2. Navigate to Settings > License.
3. Click Import License.
4. Browse to your .lic file or paste your license key.
5. Click Activate.

The portal contacts the LVS, validates the license, and displays your license details:

Field	Example
Organisation	Contoso Ltd
Tier	Enterprise
Max Users	500
Expires	2027-04-07
Features	AD, Entra ID, SSH, Database, AI, Session Recording, HA
Status	Active
Last Check-In	2026-04-07 10:30:00 UTC

---

Method 3 — REST API

Import Using a License File

PowerShell:

# Read the license file as bytes
$licenseBytes = [System.IO.File]::ReadAllBytes("C:\path\to\rppam-license.lic")
$licenseBase64 = [Convert]::ToBase64String($licenseBytes)

# Import via REST API
$body = @{
    licenseData = $licenseBase64
    format      = "file"
} | ConvertTo-Json

Invoke-RestMethod -Uri "https://localhost:7101/api/v1/license/activate" `
    -Method POST `
    -Headers @{ Authorization = "Bearer $apiToken" } `
    -ContentType "application/json" `
    -Body $body `
    -SkipCertificateCheck

Bash (curl):

# Base64-encode the license file
LICENSE_DATA=$(base64 -w 0 /path/to/rppam-license.lic)

# Import via REST API
curl -sk -X POST "https://localhost:7101/api/v1/license/activate" \
    -H "Authorization: Bearer $API_TOKEN" \
    -H "Content-Type: application/json" \
    -d "{\"licenseData\": \"$LICENSE_DATA\", \"format\": \"file\"}"

Import Using a License Key

PowerShell:

$body = @{
    licenseKey = "RPPAM-XXXX-XXXX-XXXX-XXXX-XXXX"
    format     = "key"
} | ConvertTo-Json

Invoke-RestMethod -Uri "https://localhost:7101/api/v1/license/activate" `
    -Method POST `
    -Headers @{ Authorization = "Bearer $apiToken" } `
    -ContentType "application/json" `
    -Body $body `
    -SkipCertificateCheck

Bash (curl):

curl -sk -X POST "https://localhost:7101/api/v1/license/activate" \
    -H "Authorization: Bearer $API_TOKEN" \
    -H "Content-Type: application/json" \
    -d '{"licenseKey": "RPPAM-XXXX-XXXX-XXXX-XXXX-XXXX", "format": "key"}'

Check License Status

PowerShell:

Invoke-RestMethod -Uri "https://localhost:7101/api/v1/license/status" `
    -Headers @{ Authorization = "Bearer $apiToken" } `
    -SkipCertificateCheck

Bash (curl):

curl -sk "https://localhost:7101/api/v1/license/status" \
    -H "Authorization: Bearer $API_TOKEN" | python3 -m json.tool

Expected response:

{
    "organisation": "Contoso Ltd",
    "tier": "Enterprise",
    "maxUsers": 500,
    "expires": "2027-04-07T00:00:00Z",
    "status": "active",
    "lastCheckIn": "2026-04-07T10:30:00Z",
    "nextCheckIn": "2026-04-08T10:30:00Z",
    "features": ["ad", "entraid", "ssh", "database", "ai", "session-recording", "ha"]
}

---

How Check-In Works

Once activated, RP-PAM performs automatic license check-ins with the Ravenphyre LVS:

Behaviour	Details
Check-in frequency	Every 24 hours
Protocol	HTTPS (port 443) to lvs.ravenphyre.net
Payload	Deployment fingerprint, current user count, installed version (no customer data is sent)
Response	Confirmation of license validity, updated feature flags, and any messages from Ravenphyre

The check-in is lightweight (a single HTTPS POST under 1 KB) and takes less than a second.

---

What Happens If the Internet Is Down

RP-PAM is designed to be resilient to temporary internet outages.

Duration of Outage	Behaviour
0 - 72 hours	Full functionality. RP-PAM uses the cached license and continues operating normally.
72 hours - 30 days	Grace period. RP-PAM continues operating but displays a warning banner in the web portal and logs a warning every hour.
30+ days	Restricted mode. RP-PAM continues to protect existing secrets and grants but stops accepting new access requests. Existing scheduled rotations continue. The REST API returns 402 License Check-In Overdue for write operations.

Important: RP-PAM never shuts down or deletes data due to a license issue. Even in restricted mode, all existing credentials remain accessible and scheduled rotations continue to run. The restriction only affects new access requests.

When internet connectivity is restored, the next automatic check-in resolves the issue and full functionality is restored immediately. No manual intervention is required.

---

Renewing Your License

When your license approaches expiry, RP-PAM displays a warning in the web portal and sends notifications (if configured) starting 30 days before expiry.

To renew:

1. Contact your Ravenphyre account representative or email support@ravenphyre.net.
2. Complete the renewal process. Your new .lic file is delivered via email from Ravenphyre.
3. Import the new license using any of the methods described above.

The new license takes effect immediately. No restart is required.

---

Troubleshooting

Symptom	Cause	Resolution
"License validation failed" during activation	Invalid or expired license file	Verify the file was not corrupted during download; re-download from the Ravenphyre portal
"Unable to reach LVS" during activation	Firewall blocking outbound HTTPS to lvs.ravenphyre.net	Ensure port 443 outbound is open to lvs.ravenphyre.net (see Network Requirements)
License shows "inactive" after activation	Check-in failed silently	Check logs for LVS connection errors; verify DNS resolution for lvs.ravenphyre.net
"License Check-In Overdue" errors	Internet has been down for more than 30 days	Restore internet connectivity, or switch to offline mode (see Offline Activation)
Wrong tier or feature set	Imported the wrong license file	Re-download the correct license from the Ravenphyre portal
"User limit exceeded" warning	More active users than the license allows	Contact Ravenphyre to upgrade your user limit, or deactivate unused accounts

---

Next Steps

• Offline License Activation — Activate without internet access
• LVS Relay Setup — Deploy a local relay to survive internet outages
• Setup Wizard — Complete first-time setup if not yet done

---

RP-PAM v1.0.0 — Copyright 2026 Ravenphyre. All rights reserved.