Activation & sessions

Activation turns an entitlement into a running license. A device presents an activation code and a device fingerprint; Oclavex issues a session — a signed license bound to that entitlement and device.

Codes are random by default. To give them a format of your own, or to generate or import them in bulk, see activation key formats & batches.

What a session carries

A session is the running license. It holds a snapshot of the entitled features and the applied plan (taken at activation, just as the entitlement takes its snapshot when granted), the licensed products, and its time bounds: lease, trial and grace. Devices check in to renew the lease and check out to release a floating seat. The license itself is a signed JWT your application can verify offline with the provider’s public key.

Locking a code to one device

By default any device may redeem a code, and the first one to do so takes the seat. Two settings on the code narrow that.

A required fingerprint binds the code to one machine before it is ever used. Put the device’s fingerprint on the code and only that device can redeem it. Another machine presenting the same code is refused with “This activation code is locked to a different device.” This suits a code generated for a named machine, such as a server you are provisioning for a customer, where the code travelling to the wrong host should fail rather than quietly consume the seat.

Requiring that a fingerprint is supplied is the weaker form: any device may redeem the code, but it has to identify itself. A request that carries no fingerprint is refused with “A device fingerprint is required to activate this license.” Without it, an activation with an empty fingerprint would be indistinguishable from every other empty one, so Oclavex could not tell those installs apart when reusing the seat.

The two combine. A code can require a fingerprint, and separately require that it equals a particular one.

Note

Both checks compare the fingerprint the device reports. As device fingerprints explains, that value is supplied by the client, so this keeps a legitimate install on the machine you meant it for. It is not a defence against a determined user replaying another machine’s fingerprint.

Where to find it

In the portal, open an entitlement and go to the Activation codes tab. Select a code to edit its Fingerprint. The codes list shows the column as Required fingerprint, so you can see at a glance which codes are bound and which are open.

Online, hybrid, air-gapped

• Online — the device activates and checks in over the network.
• Hybrid — it activates when connected, then runs on its lease and grace window in between.
• Air-gapped — for devices with no connectivity, the device writes a request file (unsigned; it is not secret either — it carries hashes, not raw device traits), you return a signed response (in the portal or via the API), and the device imports it; it then verifies the license by itself, with no network. Usage gathered offline is brought back the same way, answered with a signed receipt.

How it relates

• Activated from → an entitlement (its features and plan are snapshotted into the session).
• Reports to → metering: usage is recorded against the session and checked against the plan’s tiers.