Getting Started

Licensing

Your Control licence is a signed key verified entirely offline — and the same machinery lets your instance mint, reveal and revoke keys for your own customers.

Activating your instance

Buy Talon Control at talonlabs.dev/control/pricing. Checkout mints your key the moment payment completes.

The key — it starts with talctl_ — arrives by email immediately.

Paste it into your instance under Settings → License. Verification happens locally; no network call is made.

One licence, one instance — and it never locks you out

A licence covers one self-hosted instance for its covered period, with every update we ship included; renewal is a new key, pasted the same way. A missing or expired key degrades the instance to the free tier. It is never a lockout: your database, your books and your Brain stay yours and stay readable.

Why offline verification

The key is an Ed25519-signed payload: your instance checks the signature against our public key and reads the tier, seats and expiry straight from the payload. There is no licence server and no phone-home — an air-gapped Control install is a fully licensed Control install.

That is a deliberate consequence of the self-hosted promise: nothing about your company — not usage, not even liveness — reaches us after purchase. It also means the appliance cannot be switched off remotely, by us or by anyone who compromises us.

Issuing keys to your customers

The licence console Control was born as is yours to use: register customers, mint signed offline keys for your own products, reveal a key under audit when a customer loses it, and revoke what should no longer verify.

Mint — every key you issue is signed with your own Ed25519 private key and verifies offline against your public key, the same way ours do.

Reveal under audit — reading a minted key back is itself an event in the append-only log: who revealed it, when, for whom.

Revoke — mark a key revoked in the ledger; your product's own verification path decides what revocation means for it.

talctl_ — your Control licencetalon_ — keys you mint for customersEd25519 · offline · append-only audit

The signing key

Minting needs an Ed25519 private key mounted read-only into the container at the path TALON_CONTROL_SIGNING_KEY_PATH names. Generate it once, on a machine you trust:

terminal

mkdir -p ~/control/secrets && chmod 700 ~/control/secrets

openssl genpkey -algorithm ed25519 \

  -out ~/control/secrets/license-signing-private.pem

chmod 600 ~/control/secrets/license-signing-private.pem

# The public half — the one your own product verifies against

openssl pkey -in ~/control/secrets/license-signing-private.pem -pubout

Escrow the private key. There is no recovery: lose it and every outstanding licence has to be re-minted under a new key and redistributed to every install that verifies against the old one.

Pin the public key in whatever you are licensing. Rotating means prepending the new public key to that product's trusted list, not replacing — verification walks the list in order, so keeping the old key below it lets every already-issued licence keep verifying through the rollover.

Keep the mount read-only. Nothing in the app writes it, and minting is disabled outright when it is absent — the console runs fine either way.

Not a page in the app, on purpose

Control never renders a signing key in a browser. Its only two destinations are your password manager and a read-only mount on the host — a key on screen is one screenshot or one log line away from being someone else's ability to mint your licences.