Licensing

hev layer is licensed per environment. Design-partner and trial installs use the same license path as production: sign up, receive a key by email, install the key with Helm, and monitor the gateway’s local license state.

Start a Trial

Use the trial signup on the hev layer site. Submit the email address you want associated with the install; hev layer emails back a signed trial key and the current install instructions.

The key is the only license material you need for a standard self-hosted install. Treat it like a deployment secret: store it in your secret manager, do not commit it to source control, and avoid pasting it into support tickets or docs.

Self-hosted customer installs pull the Layer-owned pro images from Docker Hub: hevlayer/layer-gateway-pro:<version>, hevlayer/layer-operator:<version>, and hevlayer/layer-dashboard:<version>. These images are only useful with a valid license key; without one, licensed gateway routes, operator actions, and dashboard write surfaces project to the license floor.

Install the Key

For Helm installs, pass the emailed key as license.token:

helm upgrade --install layer ./infra/helm/layer \
  --namespace layer --create-namespace \
  --set license.token="$HEVLAYER_LICENSE" \
  -f values.customer.yaml

If your cluster policy requires pre-created Kubernetes Secrets, create the Secret through your normal secret workflow and point Helm at it with license.existingSecret and license.secretKey.

See the install guide for the full values table.

License Claims

The license key is a signed PASETO v4.public value issued by hev layer and verified locally by the gateway, operator, and dashboard. Verification is offline: the cluster does not call a license server to answer license health.

The license answers what the deployment is entitled to: sub, tier, features, limits, iat, and exp. API keys still answer who the caller is and what that caller may do. A request must pass both checks.

The initial feature strings are:

Feature	Gates
transform-runtime	Pipeline, Function, UDF, worker dispatch, and scaling surfaces.
agents	Agent management and invocation surfaces.
rbac	Scoped key mint/manage routes and multi-tenant enforcement.
warehouses	Warehouse APIs and data-supply verification.
doc-cache	Managed document cache, blob, and cache-backed warm paths.
history	Search history, clickstream, checkpoints, restore, and activity.
cost	Cost and fin-ops APIs and dashboard panels.

Core gateway routes are not represented as license features. Queries, point reads, writes, scans, namespace metadata, snapshots, and backend routing remain available in every license state.

License States

The gateway evaluates license state locally from its configured key. It does not require a network callback to answer license health.

State	Meaning
licensed	The key is valid and the current time is before its expiration. Licensed Layer surfaces are available.
grace	The key has expired, but the install is still inside its grace window. Licensed surfaces continue to work while renewal is handled. Responses on gated routes include a grace signal.
floor	No valid key is configured, or the key is past expiration plus grace. Licensed surfaces are refused or degraded to the CE behavior.

Read the local state with:

curl -H "Authorization: Bearer $LAYER_API_KEY" \
  https://<gateway-host>/v2/license

The response includes whether the key is valid, the licensed subject, tier, features, limits, expiration, and the gateway’s licensed / grace / floor projection. Operator and dashboard enforcement use the same state model.

End-to-End Runbook

The full-fidelity license acceptance run is scripted:

scripts/license-e2e-real.sh

The script uses a per-run plus-addressed inbox, stands up a disposable kind cluster from infra/helm/layer, installs the extracted key with license.token, checks GET /v2/license, and queries PostHog when a read key is available. Each leg is independently gated and the final report says exactly which credential or local tool unlocks the next assertion. It never runs the grace/floor walk against the shared AWS cluster.

No-key installs do not get grace. Grace is a lapse cushion measured from a real exp, not a free evaluation runway.

Read the current gateway projection with GET /v2/license.

Metrics

License health is exported with the gateway metrics and uses the license_tier and license_sub labels. Surface metrics also include surface; Phase 1 emits surface="gateway".

Metric	Type	Meaning
hevlayer_license_valid	Gauge	1 when the configured key verifies; 0 for missing or invalid keys.
hevlayer_license_expiry_seconds	Gauge	Seconds until exp; negative after expiry for a valid expired key.
hevlayer_license_grace_seconds_remaining	Gauge	Seconds left before a surface drops to the floor; 0 outside grace.
hevlayer_license_degraded	Gauge	1 once a surface is on the floor.
hevlayer_license_grace_requests_total	Counter	Gateway requests allowed while the license is in grace.

Useful alerts are “license expires in less than 14 days”, any grace requests, and hevlayer_license_degraded == 1.

Renewals

When a trial or commercial license is close to expiration, request a renewal through your hev layer contact or reply to the license email. Replace the key in Helm or in the referenced Secret and roll the gateway release so it reads the new value.

Governing Terms

Document	Governs
TRADEMARKS.md / brand policy	Use of the Layer and hevlayer names, marks, and product identity.
Hosted-service Terms of Service	The operated Layer service at hevlayer.com, including acceptable use, billing, SLA, liability, and support terms.
Privacy Policy	Data handling for the hosted service, site, and product telemetry.

Self-hosting the gateway is governed by the gateway license and trademark policy. Using the hosted Layer service is governed by the hosted-service terms and privacy policy.

Client SDKs

The generated client SDKs stay Apache-2.0. They are pure onramps to the public API surface and are intended to be easy to adopt in any application.