# Self-hosted licence expiry and renewal

Source: https://codeherder.com/docs/self-host-licence/

How your server warns before the licence expires, what stops after it lapses, what stays enforced, and how to renew without losing administrator access.

To install the licence for the first time, see [Install the licence](https://codeherder.com/docs/self-hosting/#install-the-licence). This page tells you what your self-hosted CodeHerder server does as its licence runs out. It also tells you how to renew.

## Alert on the log line

The server writes a fixed WARN line when the licence is close to expiry. Alert on this text:

```
license: expiring
```

The line carries `licensee`, `expiry`, `days_left` and `threshold`. The server writes it at 30, 14, 7 and 1 day(s) before expiry. It writes at most one line per day.

After expiry, the server writes `license: expired` once per day. When the state changes, it writes `license: state changed`. Alert on all three lines.

You can also read the days left in three places:

- The **Plan & usage** card shows “N days left”. It shows a warning when 30 days or fewer remain.
- `ch workspace plan` prints the days left on the `Licence:` line.
- `GET /v1/workspaces/{id}/plan` returns `daysLeft`, `graceEndsAt` and `expiringSoon` in the `license` block.

## The grace window

An expired licence keeps its edition for 30 days. You can change nothing about this window. When it ends, the server drops to the community edition. It does this while it runs. You do not need to restart it.

## What stays enforced after the lapse

| Control | After the lapse |
| --- | --- |
| Sign-in | Stays enforced. |
| Multi-factor authentication | Stays enforced. Your identity provider enforces it. |
| Authorisation and workspace roles | Stay enforced. |
| Audit logging | Stays on. |
| Instance operator access | Stays. An operator can still reach the operator area and renew. |
| Closed sign-up | Stays closed, also after a restart. |

## What stops after the lapse

| Feature | After the lapse |
| --- | --- |
| SCIM provisioning | Stops. Your identity provider gets an error. |
| SAML single sign-on | Stops. |
| New API keys and webhooks | Stop. |
| Release downloads | Stop. |
| Licence limits | Stop. Each workspace uses its own plan limits, which are low by default. |

## Before you rely on it

- Keep one operator who signs in without SAML. That operator can still renew after a lapse.
- Leave `CH_PLAN_ENFORCE_HISTORY_RETENTION` unset. When it is set, a lapse can prune history older than 7 days.

## Renew the licence

1. Get the new licence file from the support contact.
2. Replace the file that `CH_LICENSE_FILE` points to. If you set `CH_LICENSE`, replace that value.
3. Restart the server. The server reads the licence at start only.
4. Run `ch workspace plan`. Confirm the edition is `enterprise` and the state is `active`.

A lapsed server returns to the enterprise edition as soon as it starts with the new file.