--- title: Licensing sidebar_label: license, entitlements description: "clika-cli license, projects licenses and entitlement-profiles: activating a deployment, and issuing the credentials a runtime uses." --- Two different things are called a license on this platform, and keeping them apart saves a lot of confusion. | | **Platform license** | **Runtime credential** | | --- | --- | --- | | What it licenses | The deployment itself | One project's use of the runtime | | Who issues it | CLIKA, through the license portal | Your own platform, to your own project | | Where it is applied | Once, to the whole deployment | Handed to each ClikaRT runtime | | Commands | `license *` | `projects licenses*` | The CLI has no command that issues a runtime credential: `clika-cli licenses` (plural) prints the third-party software notices, not licenses, and issuing, rotating, revealing and revoking a runtime credential happen in the web application, signed in as a user (the reason is under [Runtime credentials](#runtime-credentials)). A fresh deployment starts unactivated, and its `/api/*` surface is gated until a platform license is applied. A runtime credential is a separate artifact issued afterwards, and what it may grant is capped by what the platform license grants. ## The platform license ``` clika-cli license [command] ``` | Subcommand | Purpose | | --- | --- | | `status` | The short answer: is this deployment licensed, and until when. | | `list` | The full license record, entitlements included. | | `state` | The enforcing state, which is what the platform actually acts on. | | `activate --body '{"license_key":"..."}'` | Apply a license key. | | `update --body ''` | Replace the license, for a renewal or a plan change. | ``` $ clika-cli license status STATE PLAN EXPIRES active enterprise 2027-03-01 ``` ``` clika-cli license activate --body '{"license_key":""}' ``` `status` is the one to reach for first when a deployment answers `403` on everything, because an unactivated or expired platform license looks like a permission problem until you check. The difference between `list` and `state` is worth knowing. `list` shows the record as stored; `state` shows what the platform enforces, which is derived from the signed license rather than from editable columns. When the two disagree, `state` is the truth. ## Runtime credentials A runtime credential is issued to a **project**, which is why it lives under `projects`. ``` clika-cli projects licenses ``` | Subcommand | Purpose | | --- | --- | | `licenses ` | List a project's credentials. | | `licenses-lid ` | Get one, with its key redacted. | | `licenses-create --body ''` | Issue one. | | `licenses-update-lid --body ''` | Change its name, note or expiry. | | `licenses-reveal ` | Show the key material once, for handing to a runtime. | | `licenses-rotate ` | Issue fresh key material for the same credential. | | `licenses-revoke ` | Revoke it. | ### Two kinds `kind` is the only required field on issue, and it decides how the runtime will verify itself. | `kind` | How it works | Use it when | | --- | --- | --- | | `simple_key` | The runtime calls the platform to check its entitlement. | The runtime can reach the platform. | | `cert_bundle` | The entitlement is signed into an offline artifact the runtime verifies locally. | The runtime is air-gapped, or must keep working through a network outage. | The web application calls `simple_key` **Online** and `cert_bundle` **Offline**; both are handed to the runtime as a `CLIKA1-...` license key. | Body field | Type | Meaning | | --- | --- | --- | | `kind` | string, required | `simple_key` or `cert_bundle`. | | `name` | string | Operator-facing display name. | | `note` | string | Free-form note for whoever reads the credential list next. | | `expires_at` | string | Absolute expiry, RFC 3339, and it must be in the future. Omitted, a certificate bundle takes the 90-day default and a simple key gets no expiry. A certificate bundle is also clamped to the platform license's own window. | | `entitlements` | object | What the credential grants. Capped at issue time against the organization's and the platform license's ceilings, so you cannot issue yourself more than you hold. Omitted, a certificate bundle inherits an empty bag capped to the ceiling and a simple key inherits the project's active certificate entitlements. | | `machine_binding` | object | A signed hardware-lock policy, for `cert_bundle` only. The platform validates its shape and signs it onto the bundle unchanged; the runtime is what evaluates seats and fingerprints. Passing it with `simple_key` is refused rather than silently ignored, because a simple key has nowhere to carry it. | ``` $ clika-cli projects licenses-create 3c9a1b2d-4e5f-6071-8293-a4b5c6d7e8f9 --body '{"kind":"cert_bundle","name":"edge-fleet-2026"}' issued project license "edge-fleet-2026" (b71e...), kind cert_bundle, expires 2026-12-02 ``` ``` clika-cli projects licenses-reveal 3c9a1b2d-4e5f-6071-8293-a4b5c6d7e8f9 b71e0f3a-1234-5678-9abc-def012345678 ``` Treat the output of `licenses-reveal` as a secret. It is the material a runtime authenticates with, and this documentation deliberately shows no real key. `licenses-create`, `licenses-rotate`, `licenses-revoke` and `licenses-reveal` take `project_licenses:write`, which no API key can carry, and the CLI signs in only with an API key, so under a key they answer `403 API_KEY_SCOPE_INSUFFICIENT`. Issue, rotate, reveal and revoke in the web application; the read commands work from the CLI. Rotation and revocation are separate on purpose. `licenses-rotate` replaces the key material while the credential and its entitlements stay in place, and `licenses-revoke` ends the credential entirely. ## Entitlement profiles ``` clika-cli entitlement-profiles [command] ``` An entitlement profile is a named, reusable entitlement bag, so an organization does not have to hand-write the same set on every issue. | Subcommand | Purpose | | --- | --- | | `list` | Every profile. | | `get ` | One profile. | | `create --body ''` | Create one. | | `update --body ''` | Change one. | | `delete ` | Delete one. | ## Activation codes ``` clika-cli activation-codes list clika-cli activation-codes create --body '' clika-cli activation-codes delete ``` An activation code is what a device presents at first contact so it can enrol without an operator typing credentials into it. See also [enrollment tokens](devices.md#enrolling-a-new-device), which are the same idea for the device agent. ## Certificates ``` clika-cli pki ca-cert clika-cli crl list ``` `pki ca-cert` downloads the certificate authority certificate a client needs to verify the platform's issued certificates. `crl list` downloads the certificate revocation list, which names the certificates that have been revoked since. ## The runtime-facing API A few small groups are not really a user-facing surface. They are what a ClikaRT runtime or a device calls for itself, exposed as CLI subcommands because every documented operation is, and occasionally useful for debugging an integration. | Subcommand | Who normally calls it | | --- | --- | | `register create` | A runtime registering itself. | | `renew create` | A runtime renewing its certificate over mutual TLS. | | `revoke create` | Revoking a device license. | | `entitlements list` | A runtime refreshing its entitlement token over mutual TLS. | | `enroll create` | A device enrolling with an activation code. | | `deployments heartbeat ` | A runtime's periodic heartbeat. | | `crl list` | The revocation list. | The model serving surface has its own page: see [model deployment](model-deployment.md). ## Full command reference Every command below is generated from the deployment's own API description, so one subcommand is exactly one platform operation. Each entry names the method, the endpoint and the [MCP](mcp.md) tool name, so the same operation is identifiable whichever surface you drive it from. Path parameters are positional arguments, query parameters are flags, and a request body is `--body` or `--body-file`. The hand-written commands, the ones that stream, propagate an exit code, or hand your terminal to `ssh`, carry no operation line. The prose above covers the commands most people reach for. This section is the complete surface, for when you need the flag you have not used before. ### `clika-cli license` `license` has 5 subcommands. #### `clika-cli license activate` Activate platform license ``` clika-cli license activate [flags] ``` | Flag | Type | Default | Meaning | | --- | --- | --- | --- | | `--body` | string | none | request body (inline JSON) | | `--body-file` | string | none | request body (path to a JSON file) | | `--raw` | bool | `false` | print raw response without pretty-printing | Endpoint: `POST /api/license/activate`. MCP tool name: `post_license_activate`. #### `clika-cli license list` Get full license details ``` clika-cli license list [flags] ``` | Flag | Type | Default | Meaning | | --- | --- | --- | --- | | `--raw` | bool | `false` | print raw response without pretty-printing | Endpoint: `GET /api/license`. MCP tool name: `get_license`. #### `clika-cli license state` Get the enforcing platform license state ``` clika-cli license state [flags] ``` | Flag | Type | Default | Meaning | | --- | --- | --- | --- | | `--raw` | bool | `false` | print raw response without pretty-printing | Endpoint: `GET /api/license/state`. MCP tool name: `get_license_state`. #### `clika-cli license status` Get platform license status ``` clika-cli license status [flags] ``` | Flag | Type | Default | Meaning | | --- | --- | --- | --- | | `--raw` | bool | `false` | print raw response without pretty-printing | Endpoint: `GET /api/license/status`. MCP tool name: `get_license_status`. #### `clika-cli license update` Update platform license ``` clika-cli license update [flags] ``` | Flag | Type | Default | Meaning | | --- | --- | --- | --- | | `--body` | string | none | request body (inline JSON) | | `--body-file` | string | none | request body (path to a JSON file) | | `--raw` | bool | `false` | print raw response without pretty-printing | Endpoint: `PUT /api/license`. MCP tool name: `put_license`. ### `clika-cli licenses` #### `clika-cli licenses` Prints the copyright and license texts of every open-source component compiled into this binary (its THIRD_PARTY_NOTICES.txt). The same file is served next to the binaries on the download channel, at ``/files/installation/cli/THIRD_PARTY_NOTICES.txt. ``` clika-cli licenses [flags] ``` ### `clika-cli entitlement-profiles` `entitlement-profiles` has 5 subcommands. #### `clika-cli entitlement-profiles create` Create entitlement profile ``` clika-cli entitlement-profiles create [flags] ``` | Flag | Type | Default | Meaning | | --- | --- | --- | --- | | `--body` | string | none | request body (inline JSON) | | `--body-file` | string | none | request body (path to a JSON file) | | `--raw` | bool | `false` | print raw response without pretty-printing | Endpoint: `POST /api/entitlement-profiles`. MCP tool name: `post_entitlement_profiles`. #### `clika-cli entitlement-profiles delete` Delete entitlement profile ``` clika-cli entitlement-profiles delete [flags] ``` Positional arguments: required ``. | Flag | Type | Default | Meaning | | --- | --- | --- | --- | | `--raw` | bool | `false` | print raw response without pretty-printing | Endpoint: `DELETE /api/entitlement-profiles/{id}`. MCP tool name: `delete_entitlement_profiles_id`. #### `clika-cli entitlement-profiles get` Get entitlement profile ``` clika-cli entitlement-profiles get [flags] ``` Positional arguments: required ``. | Flag | Type | Default | Meaning | | --- | --- | --- | --- | | `--raw` | bool | `false` | print raw response without pretty-printing | Endpoint: `GET /api/entitlement-profiles/{id}`. MCP tool name: `get_entitlement_profiles_id`. #### `clika-cli entitlement-profiles list` List entitlement profiles ``` clika-cli entitlement-profiles list [flags] ``` | Flag | Type | Default | Meaning | | --- | --- | --- | --- | | `--raw` | bool | `false` | print raw response without pretty-printing | Endpoint: `GET /api/entitlement-profiles`. MCP tool name: `get_entitlement_profiles`. #### `clika-cli entitlement-profiles update` Update entitlement profile ``` clika-cli entitlement-profiles update [flags] ``` Positional arguments: required ``. | Flag | Type | Default | Meaning | | --- | --- | --- | --- | | `--body` | string | none | request body (inline JSON) | | `--body-file` | string | none | request body (path to a JSON file) | | `--raw` | bool | `false` | print raw response without pretty-printing | Endpoint: `PUT /api/entitlement-profiles/{id}`. MCP tool name: `put_entitlement_profiles_id`. ### `clika-cli activation-codes` `activation-codes` has 3 subcommands. #### `clika-cli activation-codes create` Create activation code ``` clika-cli activation-codes create [flags] ``` | Flag | Type | Default | Meaning | | --- | --- | --- | --- | | `--body` | string | none | request body (inline JSON) | | `--body-file` | string | none | request body (path to a JSON file) | | `--raw` | bool | `false` | print raw response without pretty-printing | Endpoint: `POST /api/activation-codes`. MCP tool name: `post_activation_codes`. #### `clika-cli activation-codes delete` Delete activation code ``` clika-cli activation-codes delete [flags] ``` Positional arguments: required ``. | Flag | Type | Default | Meaning | | --- | --- | --- | --- | | `--raw` | bool | `false` | print raw response without pretty-printing | Endpoint: `DELETE /api/activation-codes/{id}`. MCP tool name: `delete_activation_codes_id`. #### `clika-cli activation-codes list` List activation codes ``` clika-cli activation-codes list [flags] ``` | Flag | Type | Default | Meaning | | --- | --- | --- | --- | | `--raw` | bool | `false` | print raw response without pretty-printing | Endpoint: `GET /api/activation-codes`. MCP tool name: `get_activation_codes`. ### `clika-cli pki` `pki` has 2 subcommands. #### `clika-cli pki ca-cert` Download CA certificate ``` clika-cli pki ca-cert [flags] ``` | Flag | Type | Default | Meaning | | --- | --- | --- | --- | | `--raw` | bool | `false` | print raw response without pretty-printing | Endpoint: `GET /api/pki/ca-cert`. MCP tool name: `get_pki_ca_cert`. #### `clika-cli pki ca-chain` Download the device-enrollment CA chain ``` clika-cli pki ca-chain [flags] ``` | Flag | Type | Default | Meaning | | --- | --- | --- | --- | | `--raw` | bool | `false` | print raw response without pretty-printing | Endpoint: `GET /api/pki/ca-chain`. MCP tool name: `get_pki_ca_chain`. ### `clika-cli register` `register` has 1 subcommands. #### `clika-cli register create` Register a runtime ``` clika-cli register create [flags] ``` | Flag | Type | Default | Meaning | | --- | --- | --- | --- | | `--body` | string | none | request body (inline JSON) | | `--body-file` | string | none | request body (path to a JSON file) | | `--raw` | bool | `false` | print raw response without pretty-printing | ### `clika-cli renew` `renew` has 1 subcommands. #### `clika-cli renew create` Renew device certificate via mTLS ``` clika-cli renew create [flags] ``` | Flag | Type | Default | Meaning | | --- | --- | --- | --- | | `--body` | string | none | request body (inline JSON) | | `--body-file` | string | none | request body (path to a JSON file) | | `--raw` | bool | `false` | print raw response without pretty-printing | ### `clika-cli revoke` `revoke` has 1 subcommands. #### `clika-cli revoke create` Revoke device license ``` clika-cli revoke create [flags] ``` | Flag | Type | Default | Meaning | | --- | --- | --- | --- | | `--body` | string | none | request body (inline JSON) | | `--body-file` | string | none | request body (path to a JSON file) | | `--raw` | bool | `false` | print raw response without pretty-printing | ### `clika-cli entitlements` `entitlements` has 1 subcommands. #### `clika-cli entitlements list` Refresh entitlement token via mTLS ``` clika-cli entitlements list [flags] ``` | Flag | Type | Default | Meaning | | --- | --- | --- | --- | | `--raw` | bool | `false` | print raw response without pretty-printing | ### `clika-cli enroll` `enroll` has 1 subcommands. #### `clika-cli enroll create` Enroll device via activation code ``` clika-cli enroll create [flags] ``` | Flag | Type | Default | Meaning | | --- | --- | --- | --- | | `--body` | string | none | request body (inline JSON) | | `--body-file` | string | none | request body (path to a JSON file) | | `--raw` | bool | `false` | print raw response without pretty-printing | ### `clika-cli deployments` `deployments` has 1 subcommands. #### `clika-cli deployments heartbeat` Runtime heartbeat ``` clika-cli deployments heartbeat [flags] ``` Positional arguments: required ``. | Flag | Type | Default | Meaning | | --- | --- | --- | --- | | `--body` | string | none | request body (inline JSON) | | `--body-file` | string | none | request body (path to a JSON file) | | `--raw` | bool | `false` | print raw response without pretty-printing | ### `clika-cli crl` `crl` has 1 subcommands. #### `clika-cli crl list` Download Certificate Revocation List ``` clika-cli crl list [flags] ``` | Flag | Type | Default | Meaning | | --- | --- | --- | --- | | `--raw` | bool | `false` | print raw response without pretty-printing | ## Related - [Organizations, projects and access](projects-and-orgs.md): the projects credentials are issued to. - [Devices](devices.md): enrollment tokens and device certificates. - [Model deployment](model-deployment.md): the deployed model that runs under a runtime license. - [job definitions](job-definitions.md): `required_resources.engine`, the entitlement-gated inference engine a definition can require. - [Runtime licenses concept](../concepts/runtime-licenses.mdx): what a license means on this platform, in prose. - [License the runtime](/clikart/how-to/license-the-runtime): where a ClikaRT or Modelverse runtime reads the credential that `licenses-reveal` shows.