How license keys work

Key format

A TigerMole key looks like key/<base64url-payload>.<base64url-signature>. On activation, the proxy (or the installer) sends the backend:

• Your license key • A machine fingerprint: v1:SHA256(machine-id | primary MAC) — stable across reboots, changes only on an OS reinstall • Your hostname, or an owner label you choose • The platform identifier (win-x64 / linux-x64)

Nothing else is sent: no prompts, no code, no masked data. That fingerprint is what binds the key to a seat.

The two tiers: Individual and Team

The product commercialises two effective tiers. The backend can issue four license types, but they all resolve to one of the two:

Backend type

Effective tier

What it unlocks

TRIAL | Individual | Same features as Individual, with an expiry date

INDIVIDUAL | Individual | Local masking; you can pause it yourself on your own machine

TEAM | Team | + ED25519-signed audit log, ENC2 encryption with your key, JSON export, optional value capture, owner label per seat; masking cannot be paused

CUSTOM | Team | Legacy enterprise contracts — treated the same as Team

The free trial

A trial is, technically, a normal key that the backend assigns an expiry date to. It lasts 14 days, requires no card, and unlocks the same features as Individual.

When it expires, the proxy goes back to blocking traffic — there's no silent downgrade to a "free, fewer features" mode. To keep using TigerMole you need to activate a paid key.

Seats: 1 machine = 1 seat

Each key + machine-fingerprint combination consumes one seat. Individual and Trial licenses have 1 seat; Team and Custom have the contracted number of seats.

TigerMole is a per-user install: if 5 different users run TigerMole on the same machine, that consumes 5 seats. On a server where Claude runs under a single service account, one seat is enough.

Rolling a Team key out to many machines at once? See deploying across a fleet for unattended Windows and Linux installs.

To free a seat (so it can be reused on another machine), the only supported way today is to run, on the machine that holds it:

Copiartigermole-proxy deactivate

Changing your key

tigermole-proxy activate <NEW_KEY> re-activates the proxy in place with the new key — useful for upgrading Individual to Team, renewing a subscription, or replacing an expired key:

Copiartigermole-proxy activate <NEW_KEY>

Offline behaviour

The proxy revalidates the license against the backend approximately every 15 days, plus on every startup. If the backend is unreachable during revalidation, TigerMole keeps working on the last valid activation for up to 30 days without a successful contact.

After that 30-day window — or if the key's known expiry date has already passed — the proxy enters blocked mode: it stops forwarding traffic to Claude instead of letting it through unmasked. This is the same fail-closed policy applied when no license is installed at all.