Licensing (Self-Hosted)

ShiftIt uses an ed25519-signed license file for self-hosted deployments.

Obtaining a License

Your organisation name
Intended number of employees
Features required (time_tracking, etc.)

You will receive a shiftit.lic file plus the public key that the binary must be built with.

Installing the License

Save the shiftit.lic file to a secure location on your server (e.g. /etc/shiftit/shiftit.lic).
Set LICENSE_FILE_PATH=/etc/shiftit in your .env file (Docker) or SHIFTIT_LICENSE_FILE=/etc/shiftit/shiftit.lic in your environment (binary).
Restart the backend.

Building with the embedded public key

The backend embeds the verifying key at compile time via the SHIFTIT_PUBLIC_KEY environment variable. To build a self-hosted binary:

SHIFTIT_PUBLIC_KEY=<base64url-encoded-32-byte-key> \
  cargo build --release --manifest-path backend/Cargo.toml

For Docker, pass it as a build arg in deploy/docker/backend.Dockerfile (the reference image expects you to set SHIFTIT_PUBLIC_KEY in the build environment).

License Contents

The license controls:

tenant_id — the Zitadel organisation id this license is bound to
max_tenants — maximum number of organisations (almost always 1 for self-host)
max_users_per_tenant — maximum employees per organisation
features — enabled feature modules (e.g. time_tracking)
expiry — license expiry date (renewal required annually)

Verifying a License

Use the standalone license tool to verify a .lic file out-of-band:

cargo run --manifest-path deploy/license/Cargo.toml --bin shiftit-license -- \
  verify --key shiftit-keys.json --license shiftit.lic

Expected output:

License is valid.
Tenant: ...
Expires: 2027-05-08

SaaS Builds

The hosted SaaS service compiles out the license check entirely:

cargo build --release --features saas --manifest-path backend/Cargo.toml

In --features saas builds, check_on_startup is a no-op and SHIFTIT_PUBLIC_KEY / SHIFTIT_LICENSE_FILE are not required.