Licensing and network requirements

Dew’s Free plan needs no license. Pro and Enterprise are activated with a license key, and the server then checks that license once a day over HTTPS. This page covers what your network must allow, what happens when a check fails or a license ends, and how to move a license to a new server.

Activate a license

You activate a paid plan by entering its license key on the server. Open System → System → License, click Activate license, and paste the key from your purchase email. The plan’s features turn on as soon as the key is accepted.

The Free plan has no key and nothing to activate. A server without a license key never contacts the license server. If a license ends and its key stays installed, Dew keeps checking the key until an admin clicks Deactivate license.

Allow access to the license server

A licensed Dew server must be able to reach api.keygen.sh on port 443 (HTTPS). It connects when you activate a key and then once a day to check the license. Allow this destination in your firewall or egress filter. Nothing connects to your server from outside for licensing.

Use an outbound proxy

If your server reaches the internet through a proxy, add these lines to the environment: list of the dew service in Dew’s compose.yaml (add environment: if it isn’t there yet):

      - HTTPS_PROXY=http://proxy.example.com:3128
      - NO_PROXY=minio.internal.example.com,10.0.0.0/8

HTTPS_PROXY is the address of your proxy. Dew sends its outbound HTTPS connections through it.
NO_PROXY lists hosts Dew should reach directly, separated by commas. Add internal services the proxy can’t reach, such as an internal S3 or MinIO endpoint.

Then run docker compose up -d in the folder that holds compose.yaml. docker compose restart doesn’t apply changed settings.

If your proxy inspects TLS traffic, the Dew container must trust the proxy’s certificate authority. Save the authority’s certificate in PEM format next to compose.yaml, add it under volumes: in the dew service, then run docker compose up -d:

    volumes:
      - ./data:/app
      - ./proxy-ca.pem:/etc/ssl/certs/proxy-ca.pem:ro

On Synology, stop the dew project in Container Manager, make the same change in the project’s YAML, then build the project again. Files next to compose.yaml go in the docker/dew folder.

Offline and air-gapped servers

Paid plans can’t be activated or kept active on a server that never reaches api.keygen.sh. Offline activation isn’t available today. If your servers have no outbound internet access, contact contact@getdew.io to discuss your requirements.

If the license server can’t be reached

Licensed features keep working for 3 days (72 hours) after the last successful check. During that time Dew retries every hour, and System → System → License shows when features will stop. On the last day, admins receive an email.

If the server still can’t reach api.keygen.sh after 3 days, it switches to the Free plan until the next successful check:

Custom branding switches to the default look right away. On Enterprise, audit logs and SCIM provisioning also stop right away.
Users, extra domains, SSO sign-in and cloud storage follow the 14-day grace period below.

As soon as a check succeeds, the license and everything it covers come back.

When a license ends or changes

A license that no longer covers your server’s setup starts a 14-day grace period. This happens when a trial or license expires, when a renewal covers fewer users or a lower plan, or when the license is moved to another server. During the grace period users, domains, SSO sign-in and cloud storage keep working. Custom branding, audit logs and SCIM provisioning stop right away if your plan no longer includes them.

At the end of the grace period, Dew turns off what the license no longer covers:

Users over the limit are marked unlicensed, starting with the most recently added. Unlicensed users can still sign in and see their existing files, but can’t upload or create links. The owner account is never marked unlicensed.
Extra domains are turned off, keeping your primary domain.
SSO sign-in stops working. Connections keep their settings.
New uploads are stored on the server instead of in cloud storage. Files already in cloud storage stay available for download.

Nothing is deleted. When a license covers these features again, Dew turns back on everything it turned off and gives unlicensed users their access back, up to the new limit.

System → System → License lists exactly what will change and when. Admins get an in-app notification every day of the grace period, and an email 3 days and 1 day before it ends.

Expiry reminders

Before a trial ends, admins get an email 7, 3 and 1 days ahead. A paid license isn’t counted down. If it expires, admins get an email. You can turn license emails off under System → System → Alerts (License expired or seat limit reached). In-app notifications always appear.

How users count toward the limit

Every active user and every pending invitation counts toward your license’s user limit. An invitation counts from the moment you send it and stops counting if you revoke it. If you’re at the limit, revoke unused invitations.

Move Dew to a new server

What you need to do depends on whether the new server keeps Dew’s data folder.

Same data folder. If you move or restore the whole data folder next to compose.yaml, the license moves with it. There is nothing to do.
Fresh installation. A new installation gets a new installation ID, so it is a new server to the license. Open System → System → License on the new server and click Activate license. If the license is still active on the old server, Dew offers Move license to this server, which activates the new server and releases the old one.

You can also click Deactivate license on the old server first, then activate the key on the new one. Deactivating applies the Free plan’s limits to the old server immediately.

Deactivating always removes the license from the server, even if the license server can’t be reached. If Dew couldn’t release the license, it tells you, and Move license to this server on the new server releases it.

Back up your installation ID

The INSTALL_ID value in data/config/secrets.conf identifies your server to the license. The same file holds your encryption keys, and Dew won’t start on an existing database without it. Back up the whole data folder next to compose.yaml: it holds the database, files stored on the server and secrets.conf together. A server restored with the same INSTALL_ID keeps its license. A server with a new one needs the license moved to it.