Skip to content
AUTO/PILOT
Sign inCreate account

Licensing & offline behaviour

How the offline license token works, what it can enforce, and what it deliberately cannot.

AUTO/PILOT is designed to run in venues with hostile or absent networking. The licensing model follows from that constraint rather than fighting it.

The rule

The app contacts the server exactly twice: at first sign-in, and during update checks. Nothing else it does requires a network.

How it works

When you sign in while online, the server issues a license token: a short-lived JWT signed with an RS256 private key that never leaves the server. It carries:

  • your user id and email
  • whether your account is licensed, and how many activations you own and are using
  • the activation this machine holds
  • a tokenVersion counter
  • an issue time and an expiry (60 days by default)

The desktop app caches that token and verifies it locally against a public key it ships with. Verification is a signature check plus an expiry check — offline, instant, and impossible to forge without the private key.

Refresh

Every update check sends the cached session token back to /api/v1/auth/refresh. That is the one moment the server can say no. It re-checks:

  • Is the account still enabled?
  • Is this device still activated?
  • Does the account still hold at least one non-revoked license pack?

If all three pass, a fresh license token is issued and the clock resets. If any fails, the refresh is rejected with a specific error code and the app drops back to sign-in.

What this model cannot do

A license token already on disk cannot be revoked mid-flight. This is a deliberate trade, and it is the price of working offline at all:

  • Deactivating a device frees the slot on the server immediately — you can activate a replacement machine right away.
  • The deactivated machine itself keeps running until its cached token expires (at most 60 days) or it next reaches the network, whichever comes first.
  • The same applies to refunds, disabled accounts and revoked packs.

If you need a machine stopped right now, you need physical or administrative access to that machine. No offline-capable licensing scheme can do better, and any vendor claiming otherwise is quietly requiring a network.

Shortening the window

Administrators can reduce the exposure window by lowering LICENSE_TOKEN_TTL_DAYS, at the cost of forcing users online more often. A 60-day default suits touring DJs who may go weeks without connecting the performance machine to anything.

Verifying tokens yourself

The signing public key is published at:

GET /api/v1/license/public-key            # JWKS
GET /api/v1/license/public-key?format=pem # PEM

Pin a copy in the client. Fetch this endpoint only to pick up a planned rotation — fetching it at verification time would defeat the point of verifying offline.