Skip to content
Agent Mask

License keys

The self-hosted container requires a license key for masking requests. The service always boots without one — /health, /config, and /license stay available — but POST /mask and POST /mask/sync return 403 (code AM-5001) until a valid key is configured.

Getting a key

Section titled “Getting a key”
  • Trial — self-served at agentmask.io/get-license: enter your email, and we will send a key valid for 7 days. One free trial is available per email; repeat requests resend the active key until it expires. If you need more time after that, contact us.
  • Commercial — issued per organization for the agreed commercial term. Contact us.

Pass the key as an environment variable:

Terminal window
docker run -d --gpus all -p 8000:8000 \
  -e LICENSE_KEY="<your key>" \
  raccoondata/agent-mask:latest

Checking license state

Section titled “Checking license state”
Terminal window
curl http://localhost:8000/license
{"state": "valid", "tier": "trial", "org": "example.com", "expires_at": "2026-06-19T15:47:28+00:00"}

The startup log also prints the resolved license state.

Offline verification

Section titled “Offline verification”

License keys are signed and verified locally inside the container. The container does not contact an Agent Mask activation service to validate a key, and self-hosted masking can run without outbound internet access at runtime. This keeps license checks aligned with private-runtime deployments: masking payloads do not need to leave your environment for license validation.

What this means for your team:

  • Keep host time synchronized. The container checks expiry locally, so the host clock should stay in sync with your normal time service. Agent Mask allows small clock drift, but large skew can make a valid key look early or expired.
  • Store keys like production secrets. Offline keys are not tied to a live activation service, so a leaked key should be rotated. Put commercial keys in your secret manager and contact us if one needs replacement.

Expiry behavior

Section titled “Expiry behavior”

When a key expires mid-run, the next mask request returns 403 — but results already processed stay retrievable via GET /mask, so an expiring trial never strands in-flight work. To renew, restart the container with the new key.

See also

Section titled “See also”