Activation flows

Activation always does the same thing: it turns an entitlement into a session, a signed license bound to who or what is using it. What differs is who may activate and what identity they must prove — and that is a property you choose per entitlement, not a fixed rule.

Oclavex offers three flows, from no identity to a full account:

• Keyed — anyone with the activation code can activate. No identity.
• Email-verified — the user proves an email address first, but keeps no account.
• Account — the user registers, signs in, and gets their own entitlement.

Each flow triggers automation as a side effect — emails to your user, webhooks to your systems, and state changes inside Oclavex. This page covers all three and maps what fires.

Choosing a flow

	Keyed	Try	Email-verified	Account
Identity required	none — an activation code	none	a verified email, no password	a registered account
Your user does	presents a key (often silently)	opens the application	clicks a link in their inbox	registers → confirms → signs in
The session binds to	the device	the device	the email + device	the user (seats across devices)
A new device means	key it again	a new allowance	verify the email again	sign in again
Oclavex creates	a session	a short-lived entitlement, then a session	a session	their own entitlement, then a session
Self-service portal	no	no	no	yes — My Licenses
Best for	desktop, on-prem, air-gapped, devices	letting people use the product before they decide	“just your email” trials	SaaS with per-user licensing

The Automation actions section consolidates what every flow fires.

Keyed activation

The default, identity-free flow. A device presents an activation code and a device fingerprint; Oclavex issues a session bound to that device. Anyone holding the code can activate — so the code is the credential.

What your user does

1. Your application supplies the activation code — pasted by the user, or shipped with the app and applied silently.
2. The device activates and starts running on its license.

What Oclavex does — issues a session bound to the device fingerprint, snapshotting the entitlement’s features and plan. No email address is involved unless the entitlement carries a contact.

Automation triggered

Channel	What fires
Webhook	— no webhook fires when a device activates; Entitlement.Activated fires when you publish the entitlement (it transitions to Active)
Email	“Your activation is ready.” when the activation code is created — if configured, and only if there’s a contact email
State	a session is bound to the device; a seat is consumed

Configure it — the default. Issue an entitlement with an activation code and leave verification off. Works fully offline — see offline & air-gapped activation.

Limits — a keyed session has no cross-device continuity: every device activates with its own code, and no identity links them. Use it when the license belongs to a device, not a person.

Try activation

People use the application before they decide anything. The application presents a try code — a public code you publish on the offer — together with the device fingerprint, and Oclavex issues that browser or installation its own entitlement: its own quotas, its own meters, its own clock. No account, no email, no form.

Depends on your plan

Anonymous try, included from the Basic plan. Without it, offers issue only through the flows above. See what depends on your plan.

What your user does

1. Opens the application. That is the whole flow.
2. Uses it under the allowance the try plan sets.
3. Signs up when they want to keep going — and gets a full entitlement of their own through account activation.

What you set up

On an offer, open Anonymous try and choose:

• the plan entitlements are issued on — usually a small one whose tiers deny past the allowance, so the end of the try is a clear stop rather than a silent slowdown. Naming a plan here takes it out of self-service: nobody can request a change onto it, and no try entitlement can be moved off it. Give the try its own plan rather than pointing at one you sell;
• the lifetime, counted from the moment an entitlement is issued and never extended. A day suits a demo; seven days is the maximum, and anything longer belongs in a trial;
• how long to keep an expired entitlement before deleting it, together with the device identifier it holds. One that converts is deleted at once;
• the try code, which you can change at any time to stop the previous one working;
• how many entitlements the offer will issue — per time window, per caller address, and how many may be live at once.

What to expect

• One entitlement per device, not per visit. The same browser returning within the lifetime finds the same allowance where it left it. Clearing site data or opening a private window is a new device and a new allowance — that is the honest limit of identifying a visitor who has not told you who they are, and the issuance limits above are what bound it.
• A request that names no device is refused. The try code is public, so it identifies the offer and never the caller.
• These are not customers. Try entitlements are left out of the entitlement list, the reports, the customer mails and the outbound webhooks unless you ask for them by name. The Show try licenses filter on the entitlements grid is how you ask; the dashboard counts how many are held right now.
• They cannot change plan or top up credits. Both answer with an invitation to sign up.

Email-verified activation

Just an email, still identifiable. The user gives an email address and clicks a verification link before the device activates — proving the address without creating an account or password. This is the “go live with just your email” path.

What your user does

1. Enters their email in your application.
2. Receives a verification link and clicks it.
3. The device activates once the link is confirmed.

What Oclavex does — sends the verification email, and on confirmation issues a session bound to that email and device. There is still no account and no portal login.

Automation triggered

Channel	What fires
Email	a verification link (before activation); “Your activation is ready.” is tied to code creation (if configured), not to the device activating
Webhook	— none on device activation; Entitlement.Activated fires when the entitlement is published
State	a session is bound to the email + device

Configure it — set the entitlement’s (or its activation code’s) authentication to require email verification. Everything else — plan, trial, seats — behaves the same as a keyed entitlement.

Limits — verification is per device: a second device re-verifies the same email. The email proves an address, not a login, so there is no My Licenses portal for the user.

Account activation

Full self-service signup, one entitlement per user. The user registers, confirms their email, and signs in. On confirmation Oclavex gives them their own entitlement, cloned from an offer you publish, so each user gets an isolated license — their own plan, quotas and credit balance. Signing in and activating binds a session to them, not just a device.

What your user does

1. Registers with an email and password on your sign-up page.
2. Confirms their email from the link Oclavex sends.
3. Signs in, and the application activates their license.

What Oclavex does

• On registration, sends a confirm-your-email link.
• On confirmation, issues their own entitlement from your offer and assigns it to them — it appears in their My Licenses portal before they ever open the app.
• On sign-in, activation automatically selects their assigned entitlement and binds a session to the user. Additional devices are extra seats on that same entitlement.

Automation triggered

Channel	What fires
Email	confirm-your-email (on register); plan-change outcome (if they switch plans)
Webhook	Entitlement.Activated when their entitlement is published (issued from your offer); Entitlement.PlanApplied (on a plan change) — nothing fires when the device itself activates
State	their entitlement is issued and assigned; a session binds to the user; seats accrue per device

Configure it — publish an offer marked to issue to new users, with the plan and any trial the clones should inherit. The self-service My Licenses portal requires the end-user portal capability, included from the Professional plan up.

Note

There is no “user registered” or “email confirmed” webhook — the first webhook your systems receive for a new user is Entitlement.Activated, when their entitlement is issued and published from your offer. Device activation itself fires no webhook. Watch email confirmations through the portal or the admin API if you need the earlier signal.

Limits — the heaviest flow: it manages accounts and issues a license per user. Use it when licenses belong to people who return across devices and manage themselves.

Automation actions

“Automation” spans three channels, and every flow above fires into them:

• Emails reach your end user — verification and confirmation links, and the “Your activation is ready.” notice (sent when an activation code is created, if configured). Which ones send depends on the flow.
• Webhooks reach your systems so billing, CRM and automation stay in sync without polling. Every payload is a CloudEvents envelope, signed per Standard Webhooks — see the full event catalog.
• State changes happen inside Oclavex — an entitlement issued, a principal assigned, a session bound, a seat consumed — visible in the portal and the admin API.

This matrix maps each lifecycle moment across all three, regardless of flow:

Moment	Email to your user	Webhook	State in Oclavex
Registration submitted (account)	confirm-your-email link	—	account created, pending
Email confirmed (account)	—	—	their entitlement issued & assigned
Verification requested (email-verified)	verification link	—	—
Entitlement published (vendor action)	—	Entitlement.Activated	entitlement live, ready to activate
Activation code created	“Your activation is ready.” (if configured)	—	—
Device activates (all flows)	—	—	session bound; seat consumed
Plan changed or approved	plan-change outcome	Entitlement.PlanApplied	applied plan updated
Trial nearing its end	trial reminder	Entitlement.TrialExpiring	—
Subscription period renews	—	Entitlement.Renewed	period extended
Quota tier crossed	overage notice	MeteredUsage.OverageStatusChanged	—
Prepaid credits run low	—	CreditBalance.StatusChanged	—

Subscribe only to the event types you need — exactly (Entitlement.Activated), by prefix (Entitlement.*), or all (*) — and verify every delivery’s signature. The receiving contract, with code, is in Receiving webhooks.

Note

Payment, invoice and charge events come from your billing provider, not Oclavex — its automation covers the licensing, usage and privacy lifecycle.

Which flow should I use?

• License a device, or ship offline / air-gapped? Use keyed activation — no identity to carry, works with no network.
• Want people to use the product before they commit to anything? Use try activation — each browser gets a small allowance of its own, and the sign-up comes when it runs out.
• Want to know who is trialing, without asking them to make an account? Use email-verified activation — one click, no password.
• Selling per-user SaaS where people return across devices and manage their own licenses? Use account activation — each user gets their own entitlement and a self-service portal.

An entitlement can require more than the minimum: an offer set up for account activation can also require email verification, so you can add stronger identity checks later.

How it relates

• Turns into → a session, described in Activation & sessions.
• Issued from → an entitlement or offer; the account flow clones one offer per user.
• Notifies through → webhooks and their event catalog.
• Meters into → metering, quotas & credits, which records usage against the session and raises the overage and credit events above.