How license keys work
Key format, what gets sent on activation, the two commercial tiers, seats, the free trial, changing keys, and offline behaviour.
Key format
A TigerMole key looks like key/<base64url-payload>.<base64url-signature>. On activation, the proxy (or the installer) sends the backend:
- Your license key
- A pseudonymous device identifier
- Your hostname, or a managed label you choose
- The platform identifier (
win-x64/linux-x64)
The IP address and request time may appear in technical infrastructure logs. License requests do not include prompts, responses, code, detected secrets, audit logs or product-usage metrics. Masked content is sent to the provider selected by Claude Code or Codex.
Available tiers
TigerMole offers Individual and Team. Both enable supported Claude Code and Codex workflows.
| Mode | Effective tier | What it enables | | --- | --- | --- | | Trial | Individual | Individual features for 14 days | | Individual | Individual | Local masking on one seat | | Team | Team | Local metadata audit, ED25519 signing, JSON export, per-seat labels and optional X25519 encryption |
The free trial
A trial is a key with an expiry date. It lasts 14 days, requires no card and enables the same features as Individual.
When a license expires or becomes invalid, TigerMole disables masking and displays a warning. Claude Code and Codex continue working without TigerMole protection; activate a valid key before sending sensitive content.
Seats
Each key and per-user installation combination consumes one seat. Individual and Trial include 1 seat; Team includes the contracted number of seats.
TigerMole is a per-user install: if 5 different users run TigerMole on the same machine, that consumes 5 seats. On a server where Claude runs under a single service account, one seat is enough.
Rolling a Team key out to many machines at once? See deploying across a fleet for unattended Windows and Linux installs.
To free a seat (so it can be reused on another machine), the only supported way today is to run, on the machine that holds it:
tigermole-proxy deactivate
Changing your key
tigermole-proxy activate <NEW_KEY> re-activates the proxy in place with the new key — useful for upgrading Individual to Team, renewing a subscription, or replacing an expired key:
tigermole-proxy activate <NEW_KEY>
Offline behaviour
The proxy revalidates the license against the backend approximately every 15 days, plus on every startup. If the backend is unreachable during revalidation, TigerMole keeps working on the last valid activation for up to 30 days without a successful contact.
After that 30-day window—or when the known expiry date has passed—TigerMole disables protection and displays a warning. The AI tool continues working without masking.