License keys
How keys are issued, rotated, and what they bind to
A license key authenticates the gateway to the cloud. Format: ECG- followed by 32 hex chars (e.g. ECG-A1B2C3D4E5F6...).
When you get one
- Tenant approved — the first key is issued automatically and emailed with your approval letter.
- Add a gateway — facility admin → Gateways → + Add Gateway. The key is shown once; copy it before closing the dialog.
Plans cap how many active keys a tenant can hold (see Plans & billing). Revoking a key frees a slot.
What a key is bound to
The first time a gateway calls the cloud with a key, the cloud records the gateway's hardware fingerprint. Subsequent calls with that key from a different fingerprint are rejected (bound_to_other_device) — this prevents copying a key file to a second box to bypass the gateway cap.
To move a gateway to new hardware: revoke the old key, issue a new one, install on the new box.
Status flow
active → revoked (admin action) or suspended (subscription issue) → cannot be reactivated; issue a new key instead.
Where to find them
- Facility admin — Sidebar → Gateways. Shows label, key prefix, last-seen IP, last-seen timestamp.
- OFFIN super / ops — Sidebar → License Keys under the OFFIN Platform section.
Lost a key?
Keys cannot be retrieved after issuance — the cloud only stores a SHA-256 hash. Revoke the key on the dashboard, issue a new one.