License key

A license key is a single signed string that tells Nussknacker which components a given installation may use and until when. It is required: without a key no component delivered by a component provider is available, so a Nussknacker installation has to be given one before it is of any use. Built-in components such as filter, choice, variable and split are never restricted, so the Designer stays usable and can explain what is missing.

Configuration

The key is read from the top-level licenseKey entry of the Designer configuration, or from the NU_LICENSE_KEY environment variable.

licenseKey: "eyJ0eXAiOiJKV1QiLCJhbGciOiJFUzI1NiJ9..."

Surrounding whitespace is ignored, so the key can be pasted across several lines. If the key is malformed or its signature does not match, the Designer refuses to start and logs the reason. A missing or expired key does not stop the Designer - it starts, locks every provider component and says so in a banner, so that an administrator can log in and correct the configuration.

The development configuration shipped in the repository (dev-application.conf) carries a key of its own so that local work needs no setup. A distributed installation has no default key and has to be given the customer's one.

What the key contains

The key is a signed token carrying the customer name, the plan name shown in the user interface, the expiry date, and separate allowlists for component names and component provider names. Its content is not secret and can be inspected with any JWT decoder.

The optional providers list unlocks everything delivered by a matching provider. The components list matches only components: an unqualified entry matches componentName, while providerName/componentName restricts the match to one provider. For example:

{
  "providers": ["ml*"],
  "components": ["kafka/kafka-source", "kafka/kafka-sink"]
}

This unlocks every component from providers whose names start with ml, and the two named Kafka components. Component and provider entries are never matched across allowlists: "provider-*" in components does not unlock a provider named provider-kafka.

An entry may contain *, which stands for any sequence of characters; every other character is matched literally. "*" in components unlocks every component, "flink*" in providers unlocks every provider whose name starts with flink, and "kafka/kafka-*" in components unlocks the Kafka provider's components whose names start with kafka-. Components are identified by name, so when a provider delivers a source and a sink under the same name, one component entry unlocks both.

The allowlists apply to components delivered by component providers. Built-in components such as filter, choice, variable or split are always available, and so are fragments.

Locked components

A component that the key does not unlock stays visible in the creator panel. It is greyed out, marked with a diamond, cannot be dragged onto the canvas, and explains on hover that it requires a license.

A scenario that already uses such a component fails validation with an error on the affected node, which also blocks its deployment. This covers fragments as well: a fragment built on a locked component is reported both in the fragment itself and in every scenario that uses it. Scenarios that are already running on the cluster are not touched.

No key and expiry

Both a missing key and an expired one unlock nothing: every component delivered by a component provider becomes locked until a valid key is provided. The Designer keeps working and running scenarios keep running, but scenarios using locked components can no longer be deployed.

The user interface shows the plan name next to the logo at all times. Two weeks before expiry that chip turns amber and starts counting down - in days, and in hours over the last two days. A banner across the top of the page appears only when nothing is licensed, that is when the key is missing or expired.

A Designer that is left running across the expiry moment applies the restriction on its own, without a restart.