This documentation describes AuthBox v0.3.0-133-g71cb5564.

Authbox Source Available License 1.0

Copyright © 2026 App Guys LLC All Rights Reserved.

Authbox is source available, not open source. A deployment of modest size — up to one hundred enrolled people standing alone, or up to twenty-five across a federation of at most four deployments — may be run in production under the Community Use terms of section 7; everything larger, and every other production or operational use, requires a commercial license from App Guys LLC.

This license lets anyone read, build, and evaluate Authbox, and lets an individual or an organization run it in production for its own people and systems at team scale (section 7). Only the people a deployment is the authority for — those it has issued a credential of its own — count toward that scale; people who arrive through an identity provider or directory somebody else operates, and machines, services, and doors, do not. It does not let anyone run it beyond that scale, offer the Software as a service, or ship it inside another product. Those rights are available only under a separate written commercial license from App Guys LLC (section 9).

1. Definitions

"Software" means the Authbox software in this repository, in source or compiled form, including its documentation, build files, datasets, specifications, and other files authored by App Guys LLC, and any Modifications. The Software does not include Third-Party Components (section 12).

"App Guys" means App Guys LLC.

"You" means the individual or legal entity exercising rights under this license, including any organization on whose behalf that individual acts.

"Evaluation Use" means use for the purposes listed in sections 4 and 5, and, for the U.S. Government and its contractors, the purposes listed in section 6.

"Production Use" means any use other than Evaluation Use, including any operational deployment; any use that processes real (non-test) identities, credentials, certificates, or authorization decisions relied on by people or systems; any internal business, mission, or operational use by a company, organization, government agency, military organization, contractor, or other institution; and any use that provides the Software's functionality to third parties.

"Deployment" means one installation of the Software operated as a single authority: one writer instance, together with the replicas, doors, proxies, sidecars, and other Software components that take their configuration and decisions from it. Two writers are two Deployments, and a federation of Deployments is as many Deployments as it has writers.

"Standalone Deployment" means a Deployment that is not Linked to any other Deployment. A Deployment's own replicas, doors, proxies, and sidecars, and its integrations with the operating organization's own directory, single sign-on, provisioning, certificate authority, and applications, do not make it Linked.

"Linked" means that two or more Deployments are configured to trust, chain to, peer with, or federate with one another, or to exchange identities, credentials, decisions, missions, markings, or records with one another, by any mechanism, including peer agreements, chained authorities, shared trust anchors, streams between doors, and forwarding of decisions. Deployments that are operated by one organization and share nothing but that organization are not Linked.

"Enrolled Person" means a natural person for whom a Deployment is the authority: one who holds an unexpired, unrevoked credential that the Deployment issued to them — a certificate, an SSH certificate, a token, or any other credential meant to outlast a session. A person is not an Enrolled Person merely because a Deployment authenticates them on the strength of an assertion from an identity provider or directory that somebody else operates, looks them up in such a directory, holds an account that was provisioned for them from it, or permits or refuses their requests at a door; and a credential issued to a service, a workload, a machine, a device, a door, or another Software component is nobody's. A person is counted once however many credentials or Deployments they hold.

"Community Use" means Production Use that satisfies all of section 7's conditions.

"Modification" means any change to, addition to, or derivative work of the Software.

"Commercial License" means a separate written agreement with App Guys granting rights beyond this license.

"Permitted Uses" means Evaluation Use and Community Use.

2. Copyright and Ownership

The Software is the property of App Guys and is protected by copyright and other intellectual-property laws. This license grants limited permission to use the Software; it does not transfer ownership of anything. All rights not expressly granted are reserved by App Guys.

App Guys claims no ownership of, and this license does not purport to license, data, configuration, or cryptographic key material that you generate using the Software.

3. Limited License Grant

Subject to your compliance with this license, App Guys grants you a limited, non-exclusive, non-transferable, non-sublicensable, royalty-free license to use the Software solely for the Permitted Uses in sections 4 through 7. This grant is a copyright license only; no other intellectual-property rights are granted (section 14).

4. Permitted Uses

You may, without a Commercial License:

1. view and inspect the source code;
2. clone the repository;
3. compile and build the Software;
4. run the Software for personal development, testing, evaluation, interoperability testing, security testing and research, and proof-of-concept work;
5. make Modifications privately, solely in support of the uses above; and
6. evaluate the Software as part of a potential procurement.

5. Evaluation Use

Evaluation Use must be non-production: it must not serve real users, workloads, or systems that rely on its authentication, authorization, or certificate decisions for operational purposes. A proof-of-concept deployment remains Evaluation Use only while it is not an operational or production system. When an evaluation concludes that the Software will be used operationally, that use requires either a Commercial License or qualification as Community Use (section 7) before it begins.

6. U.S. Government Evaluation

U.S. Government agencies, and contractors acting on their behalf, may use the Software without a Commercial License solely for: acquisition evaluation; procurement evaluation; laboratory testing; interoperability testing; cybersecurity and security assessment; compliance assessment; and proof-of-concept deployments that are not operational production systems.

Operational or production use by a government agency or contractor requires a Commercial License or other written agreement with App Guys, except to the extent section 7 permits a Community Use on the same terms as anyone else's. This license grants the U.S. Government only the limited evaluation rights stated in this section and the Community Use rights stated in section 7; it does not grant unlimited rights, government-purpose rights, or ownership rights in the Software. Rights for government use beyond evaluation may be negotiated separately in an applicable order, agreement, or contract (section 18).

7. Community Use

An individual, for their own purposes, or an organization, for its own internal purposes, may make Production Use of the Software without a Commercial License, on these conditions:

1. the Deployment is within one of these two limits: (a) it is a Standalone Deployment with at most one hundred (100) Enrolled Persons; or (b) it is Linked with at most three (3) other Deployments — a Linked set of at most four (4) — every Deployment in the set is operated under this section, and the Enrolled Persons of the whole set, counted once each, number at most twenty-five (25). An organization may operate any number of Deployments under this section — a team's, a site's, a project's — each within its own limit. A Deployment or a Linked set that would exceed its limit requires a Commercial License for every Deployment in it, in place before the limit is exceeded;
2. each Deployment serves only the operating individual's own purposes, or the operating organization's own employees, contractors, members, and systems — it does not provide the Software's functionality to third parties, is not offered as a service, and is not embedded in a product that is sold, licensed, or hosted for others;
3. every restriction in section 8 that is not expressly relaxed by this section still applies, including those on redistribution, sublicensing, competing products, and notices; and
4. the operator keeps a written record sufficient to show, if asked, that these conditions were met at the time of use.

A government agency, a military organization, and a contractor acting on behalf of either may make Community Use on these conditions like any other operator; what section 6 reserves is every government use beyond them.

Community Use comes with no support, no service level, no warranty, and no indemnity (sections 16 and 17); support, more Enrolled Persons, larger federations, and the rights beyond these conditions are available under a Commercial License (section 9). App Guys may change or withdraw the Community Use terms for future versions of the Software; a version released under this license remains available for Community Use on the terms it was released with.

8. Prohibited Uses

Except to the extent section 7 expressly permits a Community Use, without a Commercial License you may not:

1. use the Software in Production Use, including operational deployment or internal production use by any company, organization, government agency, military organization, contractor, or other institution;
2. sell or resell the Software;
3. redistribute the Software or Modifications as a product, in source or compiled form, except that cloning or forking the repository on a source-hosting platform, with all notices intact, is permitted in support of the Permitted Uses;
4. offer the Software, or its functionality, as a software-as-a-service, platform-as-a-service, managed service, hosted service, or similar offering;
5. incorporate the Software into another commercial product or service;
6. sublicense the Software;
7. create or distribute a product that competes with Authbox and is substantially derived from the Software; or
8. remove, obscure, or alter copyright, trademark, attribution, or license notices in the Software.

9. Production and Commercial Use

Production Use other than Community Use, and any use listed in section 8, requires a separate written Commercial License from App Guys. To obtain one, contact App Guys or its commercial partner at the addresses in section 19. Nothing in this license limits the terms App Guys and you may agree in a Commercial License.

10. Modifications and Derivative Works

You may make Modifications only for the Permitted Uses. As between you and App Guys, you own your original contributions within your Modifications, but the underlying Software remains App Guys' property, and your rights to use, build, and run any Modification are governed by this license. You may not distribute Modifications except as permitted by section 8(3).

11. Redistribution

Except as stated in section 8(3), redistribution of the Software, in whole or in part, in source or compiled form, is not permitted under this license. Any permitted copy must retain this license file and all notices.

12. Third-Party Components

The Software depends on third-party components that are licensed under their own terms, identified in THIRD_PARTY_NOTICES.md. Those terms govern those components; this license applies only to code owned by App Guys, and App Guys does not relicense third-party code. You must preserve third-party notices and license texts.

13. Trademarks

"Authbox", the Authbox logos, and App Guys names and branding are not licensed under this license. You may use the name "Authbox" only to accurately refer to the Software, and you may not use it, or any confusingly similar mark, for a derived or competing product or in a way that suggests endorsement by App Guys.

14. No Transfer of Intellectual Property

Except for the limited copyright license in section 3, no patent, trademark, trade secret, or other intellectual-property right is granted, by implication, estoppel, or otherwise.

15. Termination

This license terminates automatically if you breach it. Upon termination you must stop using the Software and destroy copies in your possession, other than copies of the public repository retained solely for archival reference with notices intact. Sections 2, 12, 13, 14, 15, 16, 17, and 18 survive termination. App Guys may also seek any other available remedy.

16. Disclaimer of Warranty

THE SOFTWARE IS PROVIDED "AS IS" AND WITHOUT WARRANTY OF ANY KIND. TO THE MAXIMUM EXTENT PERMITTED BY LAW, APP GUYS DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT. YOU BEAR THE ENTIRE RISK OF USING THE SOFTWARE UNDER THIS LICENSE.

17. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW, APP GUYS WILL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, REVENUE, DATA, OR GOODWILL, ARISING OUT OF OR RELATED TO THIS LICENSE OR THE SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY. APP GUYS' TOTAL LIABILITY UNDER THIS LICENSE WILL NOT EXCEED ONE HUNDRED U.S. DOLLARS (US $100).

18. Governing Agreement / Commercial Licenses

If you or your organization have a separate written agreement with App Guys covering the Software — including a Commercial License, or a government order, agreement, or contract — that agreement governs to the extent it conflicts with this license. Commercial and government contractual rights, including any rights beyond the evaluation rights in section 6, may be separately negotiated in such an agreement.

19. Contact / Commercial Licensing

App Guys LLC — commercial and government licensing: licensing@appguys.ai, or the AuthBox team at authbox@appguys.ai

SPDX-style identifier for this license: LicenseRef-Authbox-Source-Available-1.0