Licenses

New OxideVM runtime releases require a license token on public sites. Local development needs no account or token.

Use	What you need
HTTP or HTTPS on localhost, *.localhost, 127.0.0.0/8 or [::1]	No account or token
Public personal project, unpaid education or non-profit project	Free registered token
Company work or paid product	Manually approved commercial token
Public self-hosted engine	Manually issued token with self-hosting permission

Private LAN addresses and custom development domains outside the local list need a token. The exemption follows the embedding application’s browser origin. A public parent cannot obtain it through a runtime frame on localhost.

Register a free public license

1. Open OxideVM Accounts.
2. Enter an email address you control.
3. Open the single-use sign-in link within ten minutes.
4. Select Create license.
5. Enter a project display name and up to 16 exact HTTPS origins.
6. Confirm non-commercial eligibility and accept the current terms.
7. Copy the token from the license page into your SDK configuration.

Use origins such as https://learn.example.org or https://learn.example.org:8443. An origin has no path, query or fragment. Register a separate origin for www when your application uses it. Automatic free issuance does not accept wildcards. Registration does not verify domain ownership or reserve a domain exclusively.

The project display name is in the public token. Do not include private information. Free tokens do not include your email address.

Configure the SDK

Keep the token in public application configuration. Replace YOUR_TOKEN with the complete token shown in your account.

import { createVM } from "@oxidevm/sdk";

const vm = await createVM({
  mode: "userspace",
  runtime: { hosting: "frame", license: "YOUR_TOKEN" },
});

System mode uses the same license configuration and also needs your own System image. See Choose a mode.

A license token is public and origin-bound. It is not a signing key. Admission verifies it offline in the Rust engine. A portal or telemetry outage does not prevent admission with a valid token. Do not make an account API request each time a VM starts.

For local development, omit license. For public self-hosting, obtain a token with self-hosting permission and use the self-hosting configuration.

Expiry and renewal

A free public token expires 365 days after issue. Both free and commercial tokens have seven days of expiry grace. Grace applies only when the signature, origin, issuer permissions and hosting permissions are valid.

During grace, new VMs can start. After grace, new creation fails. This includes creation from a restore point. Running VMs continue. A license failure does not erase files, caches or restore points.

The licensed status includes commercial, expiresAt, validity and validUntil. The dates are Unix seconds. expiresAt is the original signed expiry. validUntil is the end of grace. validity is "active" or "grace" at VM creation. It is not a live subscription status.

Open your free license and select Renew license. Confirm eligibility and accept the current terms again. Replace your application’s token with the renewed token. We send reminders before expiry and at the start of grace. Do not rely on email as your only expiry check.

Change origins or archive a record

Select Change origins to replace a free license’s name or origins. Update your application with the replacement token. The previous token retains its own permissions, expiry and grace period. Replacement does not revoke it.

Archiving stops further issuance for that record. Deleting an account removes its live portal records. Neither action can revoke an already issued offline token. Export your records before deleting an account if you need to retain them.

Commercial requests

Select Request commercial license in your account. Enter your company, intended use and exact origins. Include any public self-hosting needs in the intended use. The portal shows Awaiting review, Approved or Declined. Submitting a request does not charge you or create commercial rights.

After approval, the signed token appears in your license list. Its availability notification contains no token. Commercial changes and renewal need another request. Commercial signing keys stay outside the portal.

Errors and compatibility

A missing public token produces PERMISSION_DENIED with detail.reason: "license-required". A rejected token produces detail.reason: "license-invalid". Check the complete token, exact origin, expiry and required hosting permission. See license rejection reasons.

A license does not change browser storage permissions. Privacy settings can block site data inside the runtime frame. PERMISSION_DENIED with detail.reason: "browser-storage-blocked" means the browser refused storage access. Allow site storage for your application and the runtime origin, then retry. In Brave, review the site’s Shields cookie setting. The SDK cannot override that setting and does not substitute temporary memory for durable files. Local self-hosting uses your application’s own origin and remains token-free on the local development origins listed above.

Check detail.reason before treating a PERMISSION_DENIED error as a license refusal. File permissions and browser permissions can produce the same error code.

Older published SDK and runtime versions remain available with their original behavior. These registration rules govern new releases. Use a matched SDK/runtime pair. Offline admission depends on the supplied browser clock, and modified loaders remain an enforcement limit.

The license terms govern engine use. The Apache-2.0 SDK, MIT relay and guest software keep their own licenses. An engine token does not grant third-party software rights. The account privacy notice covers portal records, providers, retention, export and deletion.