`helix license`¶

Sub-dispatcher for license tools. Inspects the file pointed to by $HELIX_LICENSE (or --file PATH — see also the global --license / -L flag that works on every subcommand) and prints either a one-line "OK" summary plus key fields, or the full payload as JSON. This is the only subcommand exempt from the startup license gate — it has to be, because it's the tool you use to audit a license that may or may not be valid.

The global --license PATH / -L PATH flag, available on every subcommand, is the recommended way to point at a license file in CI or one-shot scripts. It takes precedence over $HELIX_LICENSE when both are set. The --file PATH flag documented below is specific to helix license verify / helix license info and is preserved for backwards compatibility.

Usage¶

helix license <subcommand> [--file PATH]

Sub-commands¶

Sub-command	Description
`helix license verify`	Verify the signature and required fields; print a one-line summary plus license type, customer, issue/expiry dates, runtime/studio limits, and any watermark. Exit non-zero on any failure.
`helix license info`	Verify, then pretty-print the verified payload as JSON.
`helix license show`	Alias for `info`.
`helix license help` (or `--help`, `-h`)	Print usage.

Flags¶

Flag	Default	Description
`--file PATH`	`$HELIX_LICENSE`	Override the default lookup. Both `--file PATH` and `--file=PATH` are accepted.

Behavior notes¶

License gate exempt. This subcommand and the hidden __sandbox-exec re-exec wrapper are the only two not subject to the startup license gate. The license banner is NOT printed before these subcommands.
License files are verified against an embedded Ed25519 public key (license.EmbeddedPublicKey). The verification logic lives in pkg/license — payload schema, expiry checks, signature verification, and license-type discrimination (Runtime vs Studio vs Combined).
Lookup order for the license file: --file flag → $HELIX_LICENSE. Missing both produces a clear error and exits non-zero.
verify is intended for scripts: it prints a stable OK <license-id> header followed by fields, indented two-space style. Any failure (file missing, bad signature, expired) exits non-zero with a descriptive message.
Watermarked (non-production) licenses prefix every banner line with the watermark, both here and on the startup banner that gated subcommands print. There's no way to silence it.

Examples¶

Verify the license at $HELIX_LICENSE:

$ helix license verify
OK  lic-abc123
    file:      /etc/helix/prod.helix.license
    customer:  Acme Corp
    type:      Runtime + Studio
    issued:    2025-09-01 00:00:00 UTC
    expires:   2027-09-01 00:00:00 UTC
    studio:    25 seats (Pro), features: [graphql workflows]
    runtime:   64 vCPUs total · 16 vCPUs/node · 8 nodes · 200 QPS/node
    overage:   block
    features:  [audit ratelimit hpa]

Verify a specific file:

helix license verify --file ./test-licenses/eval.helix.license

Pretty-print the JSON payload:

$ helix license info | jq '.expires_at'
"2027-09-01T00:00:00Z"

Use in a CI gate (exit non-zero on bad license):

helix license verify --file ./prod.helix.license || exit 1

Source¶

cmd/helix/license.go lines 18-38 (cmdLicense dispatcher), 40-49 (printLicenseUsage), 53-85 (licenseFromArgs), 87-121 (licenseVerify), 123-131 (licenseInfo), 141-166 (gateStartup), 170-179 (printLicenseBanner).

The license schema and verifier live in pkg/license/.

helix license¶