Ferqon uses a one-time license model with Ed25519-signed tokens, challenge-response activation, and hardware fingerprinting. No subscriptions, no phone-home requirements after activation.
Last updated: August 15, 2026
The Ferqon licensing system has three cryptographic layers, each serving a distinct purpose:
1. License envelope (HMAC-SHA256)
The license.json file you download after purchase. Contains your license key, tier, and owner metadata, sealed with an HMAC-SHA256 integrity tag. The CLI verifies this locally before contacting the server — if the file has been tampered with or corrupted, activation is refused before any network call.
2. Challenge-response activation (HMAC-SHA256)
During activation, the server issues a single-use nonce. The CLI proves possession of your license key by computing HMAC-SHA256(nonce + ":" + deployment_id, license_key) and sending only the proof — the raw license key is never transmitted over the wire, even over HTTPS. The nonce is atomically consumed to prevent replay attacks.
3. Signed license token (Ed25519)
After successful activation, the server returns a cryptographically signed license token. The token is signed offline with an Ed25519 private key that lives on a separate signing machine — never on the web server. The Ferqon Server verifies this token on every startup using the embedded public key, with no network call required.
license.json file is sent by email and also appears on your account dashboard.Linux
curl -fsSL https://ferqon-apt.revyrlabs.workers.dev/install.sh | sudo bash
sudo apt install ferqon-cli ferqon-server
ferqon --versionWindows
.\install_windows.ps1
ferqon --versionferqon setup # auto-detect server URLlicense.json:ferqon auth activate /path/to/license.json
ferqon auth status # confirm your CLI session is validferqon server start # start the standalone server
ferqon server status # confirm it is healthyThe CLI reads the license.json envelope, verifies its HMAC integrity tag locally, collects a hardware fingerprint (CPU, MAC, disk serial, machine ID), generates a persistent deployment UUID, then performs a three-step challenge-response activation with the Revyr Labs server. The server returns a signed Ed25519 license token, which the CLI saves to disk with 0600 permissions.
license.json (v1 — HMAC-signed envelope)
{
"v": 1,
"license_id": "FERQON-2026-ABCD-1234",
"license_key": "ferqon_LK_aBcDeFgHiJkLmNoPqRsTuVwXyZ0123456789",
"tier": "pro",
"owner_email": "you@example.com",
"issued_at": "2026-07-07T00:00:00Z",
"hmac": "a3f2c1b8e9d4..."
}The hmac field is an HMAC-SHA256 over all other fields (canonical JSON, keys sorted), keyed by the license_key. This lets the CLI detect tampering before contacting the server. The license_key is a secret — treat it like a password. The license_id is a display ID safe to share with support.
Challenge-response activation (under the hood)
# 1. CLI requests a challenge nonce
POST /api/license/challenge
{ "license_id": "FERQON-...", "deployment_id": "uuid", "fingerprint": "sha256:..." }
→ { "nonce": "a1b2c3...", "expires_at": "2026-07-07T00:05:00Z" }
# 2. CLI computes proof (license_key never sent)
proof = HMAC-SHA256(nonce + ":" + deployment_id, license_key)
# 3. CLI activates with proof
POST /api/license/activate
{ "license_id": "FERQON-...", "deployment_id": "uuid",
"challenge_nonce": "a1b2c3...", "challenge_proof": "d4e5f6...",
"fingerprint": "sha256:..." }
→ { "success": true, "token": { ... Ed25519-signed license ... } }The nonce is single-use (atomically consumed in a Postgres transaction) and expires after 5 minutes. The proof binds the nonce to the deployment_id, preventing replay from a different deployment. If the server doesn't support challenge-response (older versions), the CLI falls back to sending the license key directly over HTTPS.
Optional flags: --server-name to label this deployment, --output to choose where the signed token is saved (default: ~/.ferqon_server/data/license.ferqon on Linux, or %LOCALAPPDATA%\Ferqon\data\license.ferqon on Windows), --vendor-url to override the activation endpoint.
During activation, the CLI collects hardware identifiers from your machine and computes a SHA-256 fingerprint. This fingerprint is sent to the server and stored alongside your deployment record for clone detection.
Identifiers collected
/etc/machine-id or DMI product UUID)/proc/cpuinfo)These are hashed together into a single sha256:<hex> string. The raw identifiers are never transmitted — only the hash. The fingerprint is diagnostic: it does not lock your license to specific hardware. You can migrate to a new machine by re-running ferqon auth activate /path/to/license.json (this consumes a deployment slot; release the old one first).
After activation, the CLI saves a signed license token to ~/.ferqon_server/data/license.ferqon on Linux, or %LOCALAPPDATA%\Ferqon\data\license.ferqon on Windows. This token is a JSON object with an Ed25519 signature:
{
"v": 1,
"license_id": "FERQON-2026-ABCD-1234",
"tier": "pro",
"owner_email": "you@example.com",
"activation_limit": 2,
"features": ["basic_io", "firmware_updates", ...],
"issued_at": "2026-07-07T00:00:00Z",
"update_window_until": "2028-07-07T00:00:00Z",
"expires_at": "0",
"signature": "base64-ed25519-signature..."
}On every startup, the Ferqon Server verifies the Ed25519 signature using a public key embedded in the binary (or set via FERQON_LICENSE_PUBLIC_KEY). If the signature is invalid, the server enters degraded mode (Personal-tier features only). If the token is expired but within the 14-day grace window, the server enters grace mode (full features, with a warning). After the grace window, it enters degraded mode.
Key rotation
The signing key has a version number embedded in each token. When Revyr Labs rotates the signing key, old tokens remain valid during a grace window. The public keyset is available at /api/keys/keyset for clients that need to verify tokens independently.
$0.00 one-time $0.00
$290.00 one-time $399.00
$790.00 one-time $999.00
Each tier allows a set number of concurrent active server deployments. A deployment is identified by a persistent UUID stored in ~/.ferqon_server/data/deployment_id on Linux, or %LOCALAPPDATA%\Ferqon\data\deployment_id on Windows. Re-activating the same deployment_id is always allowed (does not consume a new slot). You can manage your deployments from your account dashboard or check your current license status via the CLI:
# Show CLI session status (login + token validity)
ferqon auth statusClone detection:The server monitors heartbeat signals from active deployments. If two deployments with the same license key report liveness simultaneously from different fingerprints, the license is flagged as potentially cloned. You'll receive an email alert and can resolve it from your dashboard.
For machines without internet access, Ferqon supports offline activation via a challenge-response protocol:
The challenge contains a 32-byte nonce (expiring after 24 hours) and is cryptographically bound to your license ID. The response is an Ed25519-signed license token verified locally before import.
After activation, the Ferqon Server operates fully offline. No periodic phone-home is required. The server sends an optional heartbeat every hour when network is available — this enables near-real-time revocation detection and clone monitoring.
Operational modes
You can upgrade from Personal → Pro → Premium at any time. You only pay the difference between tiers.
To upgrade, visit your account dashboard or contact support@revyrlabs.com.
Your license.json file has been modified or corrupted. Re-download it from your account dashboard. Do not edit the file manually — any field change breaks the HMAC seal.
Ensure your license.json file was downloaded from your account dashboard and not modified. The license_key must match the format ferqon_LK_<43 characters>. Contact support with your order number if the issue persists.
The HMAC proof didn't match. This usually means the nonce expired (waited more than 5 minutes between requesting the challenge and activating) or the deployment_id changed between steps. Re-run the activation command.
Contact support to deactivate unused deployments or upgrade to a higher tier. Re-activating the same deployment_id (same machine) is always allowed and does not consume a new slot.
Re-download your license.json from your account dashboard, or email support@revyrlabs.com.
This means the license token is invalid, expired past the 14-day grace window, or the Ed25519 signature verification failed. Re-activate with ferqon auth activate /path/to/license.json to get a fresh signed token. If the issue persists, verify that FERQON_LICENSE_PUBLIC_KEY is set correctly on the server.