The Free license

Every kovra install carries a Free license: perpetual and at no cost, issued through Kaeus’ license service. It exists so that kovra can be updated; it is never a condition for using your secrets.

Your secrets never depend on the license

Whatever the license’s state — not activated, active, in grace, expired, unverifiable or unsupported — kovra run, kovra show, the MCP tools and every other command that reads or uses a secret work exactly the same. An expired or missing license only blocks updating kovra. kovra does not nag you about it on every command, and the MCP says nothing about it.

Where to get an activation code

Kaeus issues activation codes. Ask for yours through Support; there is no self-service issuance yet. A code activates one Mac at a time.

Activate this Mac

zsh

~ % kovra license activate
Activation code:
Activated.
License:  active (plan free)
Lease:    until 2026-12-05, grace until 2026-12-19 (renewed 2026-11-05)
Updates:  allowed
Your secrets work the same whatever the license's state.

• The code is read from a hidden prompt, or from stdin with --stdin. No flag takes it, so it never lands in your shell history or in argv, and kovra never logs or audits it.
• When Kaeus has published a license agreement (EULA) for kovra, activation shows it as plain text, before it asks for the code, and sends your acceptance only after you type yes. Both happen at the terminal itself (/dev/tty), never through stdout or stdin: a script that pipes the code cannot accept for you, and a redirected stdout cannot hide the agreement. Without a terminal, the activation stops there and sends nothing. Take the time you need to read it: activation does not time out while you do.
• kovra setup offers to activate too, and you can skip it.
• A code that was already used says so: a code activates only once. If another Mac holds the seat, release it there with kovra license deactivate (below) and activate this Mac with a new code from Kaeus.

After updating from 0.12.0

kovra 0.12.1 activates and renews on Kaeus’ new license service. A Mac activated with kovra 0.12.0 was activated on the previous one, which kovra 0.12.1 cannot renew, so after the update the license reads unavailable:

zsh

~ % kovra license status
License:  unavailable
Updates:  blocked — the license cannot be verified (certificate.other_issuer)
Note:     this Mac was activated on Kaeus' previous license service: activate it again with a new code from Kaeus; kovra keeps working
Your secrets work the same whatever the license's state.

Your secrets are not affected: only updating kovra waits for the new activation. To activate this Mac again:

1. Ask Kaeus for a new activation code through Support, and say that this Mac was activated with kovra 0.12.0. Kaeus releases the previous seat on its side; you do not need to run kovra license deactivate.
2. Run kovra license activate and type the new code. It replaces the previous activation, and kovrad renews it in the background from then on.

kovra does not migrate or delete the previous activation on its own. kovra doctor and the menu-bar app show the same note until you activate again.

Check it

zsh

~ % kovra license status

It shows the state (not activated, active, in grace, expired, unsupported or unavailable, with the reason), the plan, when the lease and its grace end, and whether updates are allowed or blocked and why. It answers from the local certificate, with no network. --json prints the same as JSON (the menu-bar app reads it). kovra doctor adds a one-line note on the license, and it works outside a project too. The menu-bar app shows the state and the command to activate.

The lease, the grace and renewal

• The license is a lease of 30 days, followed by 14 days of grace. While the lease or the grace runs, updates are allowed.
• kovrad renews it in the background (two minutes after it starts and then every six hours; a request goes out only once half of the lease has passed, so about every 15 days). A renewal that fails for a passing reason (no network, a slow answer, a limit) changes nothing: kovrad tries again at its next turn, on its own. Only a final answer from the license service (for example, this Mac’s activation was released or revoked), or an error in kovra itself that retrying cannot fix, stops the renewals; a successful kovra license activate or kovra license refresh starts them again, as does restarting kovrad.
• It works offline. The certificate is verified on your Mac; kovra needs the network only to activate, renew and release.
• kovra license refresh renews now instead of waiting.
• When both the lease and the grace have passed, the state reads expired and updates are blocked until you renew. Nothing else changes.

Release this Mac

zsh

~ % kovra license deactivate

This frees this Mac’s seat in the license; activating again, here or on another Mac, needs a new code. It is approved only at this Mac, in kovra’s window, never on the phone; an agent can start the command but cannot approve it. It is audited. A Mac without a license keeps all its secrets. kovra preflight covers it, so you can ask beforehand whether it will ask you.

Platforms

0.12.1 ships for macOS. On other operating systems the license reads unsupported and nothing else changes.

See also: CLI reference, Platform support.