Skip to content

Licensing

A license unlocks the full feature set of Britive Bridge. Without a valid license, Bridge still runs but falls back to a reduced limited mode (described below). Bridge validates signed licenses locally, and connected deployments can fetch and renew their license from the Britive platform automatically.

Each license is tenant-bound (issued for your specific Britive tenant) and cryptographically signed (so it cannot be forged or altered). It is a single text blob in the form payload.sig.

Providing a license

For production, the simplest option is automatic retrieval - Bridge fetches and renews the license from the Britive platform on its own. You can also provide a license directly, configured under server.license:

OptionTypeDefaultEnvironment variableDescription
server.license.keystring""BRIDGE_LICENSEThe license blob itself, provided inline.
server.license.pathstring""BRIDGE_LICENSE_PATHPath to a file containing the license blob.
bridge.yaml
server:
  license:
    path: /etc/britive-bridge/license.txt

Which source wins (precedence)

If you provide a license in more than one place, Bridge picks one in this order, highest first:

  1. Automatic retrieval from the platform (when enabled - see below). It takes precedence and keeps itself up to date.
  2. BRIDGE_LICENSE environment variable
  3. server.license.key in the YAML file
  4. BRIDGE_LICENSE_PATH environment variable, or server.license.path in the YAML file

In short, when automatic retrieval is on it wins; otherwise BRIDGE_LICENSE > key > BRIDGE_LICENSE_PATH / path. A directly-provided license still acts as a first-boot fallback until the first successful automatic fetch.

Automatic retrieval from the platform

Instead of pasting a license into your config, Bridge can fetch it from the Britive platform and renew it automatically. This is the recommended approach for connected deployments.

To turn it on, configure your Britive tenant and set the environment variable BRITIVE_BROKER_AUTH_TOKEN (the same broker-pool token used elsewhere). When it’s present, Bridge:

  • derives the license endpoint from your Britive tenant and fetches the license on startup, then checks again on a fixed daily schedule;
  • installs the fetched license as the active one and keeps it current as it renews - without piling up old licenses (each refresh replaces the previous auto-retrieved one);
  • falls back safely: if a fetch fails or returns a license that isn’t valid for your tenant, Bridge keeps the license it already has (the 30-day grace period covers temporary outages). It never downgrades a working deployment because the platform was briefly unreachable.

When BRITIVE_BROKER_AUTH_TOKEN is not set, automatic retrieval is off and Bridge uses only the license you provide under server.license.

In a clustered deployment only the orchestrator (the elected leader) does the fetching; the proxy and session workers read the resulting license from the shared database. In single-server mode the one instance does it. Either way you don’t configure anything per-node - just set the token.

The grace period

When a license reaches its expiry date, Bridge does not switch off immediately. There is a fixed 30-day grace period after expiry during which all licensed features keep working, giving you time to install a renewal. Once the grace period ends, Bridge drops into limited mode until you install a valid license.

Limited mode

Bridge enters limited mode whenever it has no license, an invalid license, or an expired license (and the grace period has passed). In limited mode Bridge stays usable but with a reduced feature set.

CapabilityLimited mode (no/invalid/expired license)Licensed
Browser-based sessionsAvailable for ssh, telnet, rdp, vnc, and k8sexec onlyAll protocols
Native (direct client) sessionsNot availableAvailable
Watching a colleague’s live sessionNot availableAvailable
Lock / unlock / disconnect a live sessionNot availableAvailable
Downloading a session recording bundleNot availableAvailable
Downloading the files transferred during a sessionNot availableAvailable
Exporting a session recording as videoNot availableAvailable
Concurrent sessions per checkoutOne onlyMultiple

A valid license therefore unlocks: native protocol access, live session viewing and control, recording, file, and video downloads, and multiple sessions per checkout.

Every one of these returns 403 in limited mode, with a message naming the feature and telling you to install a license. Nothing fails silently.

Installing or replacing a license after startup

You do not have to restart Bridge to add or update a license. A license can be installed or replaced while Bridge is running from the Admin console in the web interface. This is the easiest way to apply a renewal or upgrade.

See Operations for the Admin console, including the License tab where you install, activate, and remove licenses.

The license indicator

The web interface footer shows a small license indicator so administrators can see license health at a glance. Its color tracks how close expiry is:

  • Green - more than 60 days remaining.
  • Yellow - 60 days or fewer remaining. Plan a renewal.
  • Red - 30 days or fewer remaining, or the license has expired and the grace period is running. Renew now.

The text names the state. A green license reads Licensed, and yellow and red count down, as in License: 12 days left. Every other state has its own wording:

Indicator textStateBridge is
License expired — grace: 12 daysExpired, inside the 30-day grace periodFully operational, counting down
License expiredExpired, grace period overIn limited mode
License invalidThe signature or the tenant does not check outIn limited mode
UnlicensedNo license installedIn limited mode
LicenseThe license names a start date that has not arrivedIn limited mode

Those four limited-mode states differ only in cause, not in what Bridge will do. An invalid license is most often one issued for another tenant. A license is bound to a single tenant, and Bridge refuses one that names a different tenant rather than running on it.

Last updated on