Talon Studio runs on a Talon key: the Community key that comes with your Talon Labs account, checked offline and never reported to Talon Labs, or an Enterprise key — in development — that activates and checks in online. There is no bypass.
What it is
Talon Studio runs as the Community Edition on the Community key that comes with your Talon Labs account — without a key it shows only the key screen, and its agents and outgoing notifications pause until one is in — under the Talon Labs Community Edition Licence: no charge, and not open source. Enterprise, which is in development and not yet on sale, will be unlocked with a cryptographically signed licence key under a separate agreement.
Every key is verified offline, on your server, against a public key built into the image. A Community key is never activated or checked in, so it never contacts Talon Labs; on a Community key the one default call to talonlabs.dev is the update check, which sends nothing about the install (Offline and air-gapped). An Enterprise key also activates and checks in online — below. There is no bypass environment variable.
How it works
A licence key looks like talstu_<payload>.<signature> — an Ed25519-signed payload carrying the customer, tier and expiry (none, for a Community key). No environment variable can change which public key the image trusts.
The stored key is re-verified from its signature on every check. The licence status kept in the database is never trusted on its own, so editing it changes nothing.
Numeric limits are checked when you create something — a user, a workspace, a SIEM connection or a deployment target. Feature gates are checked when the feature is used.
The Community limits are fixed in code; no environment variable raises them.
Branches and change requests are unlimited on every edition — the review workflow is never capped. What differs is deploying: the Community Edition deploys only from main, while Enterprise can deploy another branch to its own SIEM target (a staging branch to a test SIEM, say).
Community
The Community key that comes with a Talon Labs account; no charge. 2 users · 1 workspace · 1 SIEM connection · 1 deployment target · deploys from main only · 2 read-only API tokens · single-source search · local accounts only (SSO identities already linked keep working). Detections, branches, the full Sigma library, Forge, Atlas, Monitor, Replay and Talon Claw agents are all included.
Enterprise (in development)
Signed key. Lifts the Community limits and adds OIDC single sign-on, multi-branch deploy, federated search across SIEMs, the SOC org console (one analyst queue across workspaces, for an MSSP-style setup), ServiceNow ticketing, installing curated content packs, write API scopes and the outbound MCP server. SAML, SCIM provisioning, enforced SSO and a support agreement are not built.
Setup
1
Your Community key is on your Talon Labs account, and in the welcome mail. Studio asks for it right after the first admin's password change, before anything else opens. Enterprise keys aren't issued yet; to hear when they are, register interest.
2
As an admin, click License at the foot of the sidebar. The Your plan dialog shows the current edition beside the two plan cards; choose Have a license key? Activate it, paste the key and click Activate. The /license page does the same from its License key field.
3
For automated provisioning, set TALON_LICENSE_KEY (Helm: secrets.licenseKey): the key is applied at startup, after the first admin is created.
4
The edition, expiry and limits update at once, and every entitlement check switches to the new limits.
TALON_LICENSE_KEY wins at every start
A key that fails any check — malformed, bad signature, already expired — is refused and not stored; the key already stored stays. If you use TALON_LICENSE_KEY, it is re-applied at every start whenever it differs from the stored key, so update it when a key is renewed or it will replace a key pasted in the UI.
Enterprise: activation and check-in
An Enterprise key talks to Talon Labs' licence API at TALON_LICENSE_API_URL — https://www.talonlabs.dev/api/license in the release compose file, config.licenseApiUrl in the Helm chart. That is the host to allow outbound, over HTTPS. Unset or empty, Studio makes no licence call; making no call to Talon Labs at all also needs TALON_DISABLE_UPDATE_CHECK=true, which stops the update check.
Activation. Pasting an Enterprise key binds it to this instance through Talon Labs. If Talon Labs cannot be reached, or the URL is unset, the key is stored as provisional (“Awaiting Talon Labs”) and works; the next check-in confirms it.
Check-in. Once a day, and every six hours in the 17 days before the key expires. It sends the key, this instance's id, its activation token, a counter, the app version and the hostname label — nothing about usage, users or data — and collects a renewed key when there is one.
Revocation. Only a revocation that Talon Labs signed, for this licence and this instance, is acted on. Any other answer is recorded on the License page and changes nothing.
Deactivate this instance, on the License page, releases the key's slot so it can be activated elsewhere.
Air-gapped
A Community key needs no connectivity at all. For an Enterprise key on a network that cannot reach Talon Labs, Activate offline on your Talon Labs account page takes this instance's id (shown on its License page) and gives back a key bound to it, to paste here; it works until the expiry date written into it. Offline and air-gapped covers the rest of running without the internet.
When a key lapses
An Enterprise key expires, is revoked, or is bound to another instance
The instance returns to the Community Edition and the License page says why. Nothing is deleted and nobody already in is signed out — including through an SSO identity already linked. Only creating past a Community limit is refused, and the Enterprise features switch off.
Talon Labs cannot be reached
Nothing changes. The key keeps working until the expiry date written into it; the next check-in that gets through collects the renewal.
The stored key no longer verifies or decrypts
The key screen, for everyone, until an admin pastes a key that verifies: every page opens on the License page and the API answers 403 licence_required. Nothing is deleted, and a key that stopped verifying for a fixable reason works again once the cause is fixed.
There is no key
The key screen, as on a new install.
Restores and the encryption key
The stored key is encrypted with TALON_ENCRYPTION_KEY. Restore a backup with a different encryption key and the key no longer decrypts, so the instance opens on the key screen — paste your key again (and fix the encryption key, or the SIEM credentials will not decrypt either). The same happens with an image built without Talon Labs' public key: every key reads as invalid.
Usage
The Your plan dialog counts down to expiry, turning amber inside 90 days and red inside 30. The /license page shows the status badge — active with a valid key, missing otherwise — the reason, and the expiry date.
When a Community limit is hit, the action is refused with a message naming it — for example "SIEM connection limit reached (1/1). More come with Enterprise, which is in development."
Settings → Licenses is a different page: it lists the open-source libraries and third-party detection content Talon Studio ships, and their licence terms. It doesn't hold your key.