On-prem activation and keys

Journey overview · Next: connect applications

Start a self-service evaluation

1. Sign in with a verified email at OnPrem Access. Enter your organization and intended installation hostname, select a supported deployment and accept the terms.
2. Choose Start 14-day evaluation. The server selects the latest approved compatible immutable image and issues a temporary Sandbox-only license. You cannot select permanent access, change the duration or grant yourself Hosted Live.
3. Open Your requests and retrieve the key once after recent sign-in. The installation email provides a retrieval link, image and installation alternatives; it contains no plaintext secret.
4. Follow the installation guide and enroll one Ed25519 identity. DNS ownership verification can wait until production; hostname routing, HTTPS and authorized Firebase sign-in are still required.
5. Inspect image-download setup in the request. Link the approved email to Google sign-in and use Retry image-download setup if needed. Preparation uses existing repository-scoped IAM and scheduled revocation. Failed IAM or an unhealthy expiry worker is a platform-operator task; issuance does not prove download access is ready.

The 14 days start at issuance, including time spent preparing infrastructure. One self-service evaluation is permitted per canonical organization, verified contact and account. Changing the request reference or creating another account with the same email does not restart the trial. Existing invited or non-owner team members must use their organization owner or administrator review instead of creating a second organization. This is not proof of legal company identity; suspected duplicate organizations need administrator review. Previous issued evaluations cannot be restarted through self-service. Lost keys, expired retrieval offers, extensions and repeat evaluations require an administrator.

Kubernetes and private-edge topologies require a reviewed enterprise runbook. No compatible approved image returns APPROVED_RELEASE_UNAVAILABLE; no trial is consumed until issuance commits successfully.

Request administrator-reviewed access

1. Submit the OnPrem Access form with your organization, contact and requirements. A new evaluation request may omit its installation domain. Use the same form for a renewal request.
2. An administrator selects Confirm Approval — Evaluation access and an exact expiry without DNS proof. New customers receive an evaluation organization; linking an existing organization requires explicit confirmation and preserves its established permissions. The approval email links to the hosted sandbox.
3. When ready to self-host, select your domain and deployment profile in the signed-in request before license issuance. An administrator selects one approved compatible image and confirms temporary evaluation installation access, bounded by your approved evaluation expiry. DNS ownership proof is required before production activation, rather than evaluation approval or issuance. A reachable HTTPS hostname, routing DNS and authorized sign-in domain are still required for installation and login.
4. For new request-based activations, sign in to the authenticated retrieval workspace linked by email and retrieve the installation credential once. The offer lasts at most 24 hours and never extends beyond license expiry; sign-in must be within the last 15 minutes. Self-service selects an approved compatible digest automatically; administrator-reviewed applications must also use an approved immutable digest. Activation email includes that image reference and instructions tailored to your selected deployment, without the secret. Registry reader access is separate from the key; check preparation status before pulling the image.
5. Install the key on the approved server and confirm readiness. The image registers one Ed25519 installation identity; preserve its private identity across restarts and key replacement. A license does not automatically enroll MFA or configure your identity provider. Copies, replicas and disaster recovery require review.
6. For production, publish and check a fresh TXT or CNAME ownership challenge, obtain active applied commercial entitlements and use the administrator's Confirm Production Activation decision. DNS verification alone never grants production authority.

Can we explore before verifying DNS?

Yes. Hosted evaluation requires neither an installation domain nor DNS verification. Self-hosted evaluation permits synthetic sandbox workflows only. Live trading, funding, payouts, production streams, direct API keys, data keys and OAuth tokens cannot bypass the applicable evaluation restriction. A separately approved Hosted Live organization can use its own hosted credentials directly, while the evaluation installation remains Sandbox-only. Sandbox enterprise/team/security operations remain unavailable. Sandbox and paid-license quotes currently have a 15-minute delay. Real-time delivery is unavailable pending approved feed verification. Check market-data implementation status before assuming the deployed feed changes with a license. Account-event delivery is separate from quote timing.

How does administration manage a self-service evaluation?

Open /admin/partners?tab=onprem and View self-service evaluations to see all states, including active, expired and revoked records. The request shows its issuance source, policy duration, selected deployment, image-download blocker and owner. Open license management to inspect identity and retrieval, replace an offer, revoke, or approve an evaluation extension with an exact expiry. Self-service extensions and revocations require a review reason recorded in the audit. An extension stays Sandbox-only, retires prior credentials and queues a new retrieval offer; it never promotes production.

Customer request status and administrative license state are shared records. Expiry is enforced when requests are authenticated even before the scheduled worker updates display state. Notifications and audit records accompany lifecycle decisions; queued notifications are not inbox proof.

What does the production readiness panel check?

In /admin/partners, administrators see approval, license, domain, identity, release and commercial readiness. Production confirmation requires the correct approved organization and active full credential, an active evaluation installation with enrolled identity, a fresh verified unused ownership challenge, an approved compatible image, and an active commercial contract with entitlements applied to that organization. Choose temporary expiry or permanent, revocable duration separately.

Activation preserves the stable license and installation identity, retires evaluation credentials and creates a replacement authenticated retrieval offer. Update the existing server key securely and recheck readiness. Shared state, notification and audit evidence are committed together. Existing production organizations retain their established permissions. Organizations without an explicit Hosted Live decision retain legacy direct-access checks, including linked installation grants and commercial contracts. An explicit Hosted approval establishes an independent hosted lifecycle; it never overrides installation licensing. See workspace access status.

Temporary versus permanent

Duration and entitlement are separate. Evaluation is always temporary and sandbox-only. Production can be temporary or permanent. Neither duration expands cloud API scopes, market-data licensing, trading permissions or team roles. A permanent installation does not override an expired commercial agreement.

Temporary access ends at its configured expiry. Permanent access has no scheduled expiry, but an administrator can revoke it. Both remain bound to the approved domain and partner and require successful cloud verification.

Application receipt and lifecycle notifications communicate progress. Email delivery is not proof that the installation is active: verify the administrative state and /api/health on the deployed server.

What happens when a key expires?

Protected calls are denied and the installation presents an access wall with a request link. Reminders are queued within 72 hours of expiry, once per expiry value; hosted-only approvals also receive reminders and expiry notices. Submit a renewal for review. Evaluation renewal remains temporary and sandbox-only. Confirm Production Renewal requires a fresh ownership challenge, active applied commercial contract and the existing enrolled identity. It can restore an expired production license, choose temporary or permanent duration and retire prior credentials. Ordinary production renewal does not revive revoked access. The operator retrieves the replacement credential and rechecks readiness. There is no offline grace period.

An active stream can remain open until its bounded lifetime ends; server-sent event connections reconnect at most every five minutes to revalidate authorization. Do not describe expiry as instant termination of every existing connection.

Replace or recover a key

Use the administrator's Replace key action. Issuance revokes the old key, so coordinate the change with the server operator. Rerun the reviewed installer with the same approved domain and image digest, entering the replacement at the hidden prompt (or via an owner-only key file). The installer verifies it, replaces the environment configuration and recreates/restarts the service.

A lost one-time credential must be reissued. Do not email keys, paste them into support tickets, or restore a revoked key during rollback. Keep configuration backups in a secret manager with restricted access.

Change the installation domain

A key issued for one domain does not authorize another. Ask an administrator to approve and verify the new domain, update authorized sign-in domains, DNS and TLS, and provide the appropriate replacement activation. Confirm rejection of the old configuration according to the approved migration plan.

What should an administrator verify before approval?

• Match the request to the correct partner organization and exact installation domain.
• Review the requested host, OS, CPU architecture, installation mode, proxy, network, identity provider and available resources. Select a release digest built for that architecture. Kubernetes and private-edge topologies require an agreed enterprise runbook before activation.
• Approve evaluation without DNS; confirm a fresh supplied ownership challenge before production activation or production renewal.
• Choose temporary access with an explicit expiry date/time and timezone, or permanent revocable access.
• Confirm customer retrieval status and offer expiry. Replace an expired retrieval offer if necessary; do not include keys in email or tickets.
• Confirm the activation email contains installation instructions, then have the operator verify readiness.
• For renewal, review the new request, approve the access term, replace the key and recheck readiness.

The application, license and activation email share a versioned deployment profile. Replacing a key keeps the previous profile and image unless a new approved application supplies revised choices or the administrator approves another digest. A renewal form restores your previous deployment choices for review; update them if your infrastructure has changed. Resource values describe your proposed host and expected users, not a guaranteed capacity or automatic cloud provisioning request.

Does an activation email prove access is working?

No. The email provides instructions. Registry permission, DNS/TLS, valid credentials, identity setup and successful readiness checks are separate requirements. A replacement key revokes its predecessor; coordinate the handover with the operator before issuing it.

How do TXT and CNAME verification work?

Choose TXT or CNAME in the access request. After partner approval, the administrator prepares a unique challenge for the exact installation hostname, previews the email and chooses ownership records only or all supplied records. All records includes the ownership challenge and any explicitly supplied routing record; no IP address or hosting destination is invented. Your signed-in request and verification email display the complete name, value, TTL and 72-hour expiry. The administrator can replace an expired challenge.

For an installation at onprem.hostlyke.co.ke, the full record name is _mystocks-onprem.onprem.hostlyke.co.ke. Edit the DNS zone for hostlyke.co.ke, not MyStocks. If the DNS provider appends hostlyke.co.ke, enter _mystocks-onprem.onprem as the Host. Other providers require the full name: check their zone display rather than guessing the relative name.

• TXT: enter only mystocks-onprem=CHALLENGE in the Value field.
• CNAME: enter the exact unique CHALLENGE.onprem-verification.mystocks.africa target supplied by the application. The alias itself proves ownership; this verification target is not the API hosting address.
• Recommended TTL: 300 seconds, or the provider's supported Automatic setting.

Use one method at the verification hostname; do not add a TXT record alongside a CNAME at the same name. Keep installation routing records and HTTPS certificates separate. Customers and administrators can check DNS independently; shared status shows pending, checking, verified or failed, the last check and error. Retry failed checks. A transient failure after successful verification preserves historical proof and displays the latest error; it does not silently revoke existing access. Verification never promotes production access. Signed installation proofs bind protected requests to the enrolled identity; DNS alone cannot prevent credential copying.

Lost or expired retrieval offers

For a customer-delivered license, administrators use Replace retrieval offer & notify customer in the license workspace. This invalidates the previous offer without renewing the license. A previously retrieved credential remains valid until the replacement is redeemed; redemption revokes the old credential, so coordinate the server update. The license ID remains stable, including its image-registry grant association.

The approved applicant must use the verified account that submitted the request. Forwarding the email does not authorize a different user. Successful retrieval produces the key once, directly into the signed-in page; storage and notification payloads contain no plaintext credential. If the response is lost or the page is refreshed before the key is saved, request a replacement offer. Legacy administrator-delivered licenses retain their existing process until migration.

One-action evaluation preparation

Administrators use Prepare evaluation package after organization approval. It upgrades eligible older evaluation requests without changing existing production permissions, selects the latest tested compatible standard image, prepares authenticated key retrieval and provisions repository-only download access for the approved, verified Google-linked account. Evaluation registry access is bounded by approval and license expiry and uses scheduled revocation. Missing images, registry permissions, expiry-worker health or customer setup are shown with the responsible owner and a retry action. No production commercial contract is created for evaluation.

The signed-in customer request displays the same next task. DNS challenges last 72 hours and are checked automatically by the existing scheduler; customers can still check immediately. Background verification updates ownership status only. Publication, production confirmation and commercial entitlement remain explicit decisions.

Once an administrator authorizes evaluation package preparation, the existing registry-expiry worker retries incomplete packages in bounded batches. It resumes after customer prerequisites or release availability change; it never approves a request or renews an expired evaluation automatically.