Boundary Enterprise licensing

The Boundary Enterprise binaries require a license key to enforce entitlements and time restrictions according to your contractual agreement. Once purchased, your HashiCorp account team sends you a valid Boundary license to activate the environment. If you don't yet have an acccount team, but are interested in Boundary Enterprise, you can contact sales.

Enable Boundary Enterprise

Once you have received your valid Boundary license, there are two options for enabling Boundary Enterprise:

1. You may set the enterprise license for Boundary using an environment variable. Set the BOUNDARY_LICENSE environment variable to the license key value you received:

   $ export BOUNDARY_LICENSE=02MV4UU43BK5...

   or

   $ BOUNDARY_LICENSE=file:///folder_path/license.hclic

2. You may specify the enterprise license key in the Boundary controller configuration using the license attribute in the controller block. You can either specify the raw license key or the path to a file containing the license key. Refer to the sample configurations below:

   Sample #1

   controller {
     name = "controller"
     description = "controller"
     database {
       url = "postgresql://boundary:PASSWORD@127.0.0.1:5432/boundary"
     }
     public_cluster_addr = "boundary.domain"
     license = "file:///folder_path/license.hclic"
   }
   

   Sample #2

   controller {
     name = "controller"
     description = "controller"
     database {
       url = "postgresql://boundary:PASSWORD@127.0.0.1:5432/boundary"
     }
     public_cluster_addr = "boundary.domain"
     license = "02MV4UU43BK5..."
   }
   

Refer to the controller configuration documentation for more information.

License expiration

When the account team generates a new Boundary Enterprise license, it contains an expiration date based on your contractual agreement. Prior to the license expiration, Boundary logs five system event warnings to the event stream at the following intervals:

If you use an external monitoring system, you can create alerts for "msg": "license warning" and "op": "licensing.StartWatching" to watch for license expiration warnings.

Refer to the following example of how the warnings appear in the log:

{
  "id": "ymFHcb1H1Z",
  "source": "https://hashicorp.com/boundary/nixos/controller+worker",
  "specversion": "1.0",
  "type": "system",
  "data": {
    "version": "v0.1",
    "op": "licensing.StartWatching",
    "data": {
      "expiration_time": "2025-09-08T11:14:33-07:00",
      "msg": "licensing warning",
      "time_left_seconds": 60
    }
  },
  "datacontentype": "text/plain",
  "time": "2025-09-08T11:14:03.457471753-07:00"
}

When the license expires, you receive the following message as an error:

{
  "id": "SJkaNV09xP",
  "source": "https://hashicorp.com/boundary/nixos/controller+worker",
  "specversion": "1.0",
  "type": "error",
  "data": {
    "error": "error from licensing watcher: invalid license or license is expired",
    "error_fields": {},
    "id": "e_33IKa8BqB3",
    "version": "v0.1",
    "op": "licensing.StartWatching"
  },
  "datacontentype": "text/plain",
  "time": "2025-08-01T16:54:14.34408533-07:00"
}
==> Boundary dev environment self-terminating
==> Health is enabled, waiting 0s before shutdown
==> Boundary dev environment graceful shutdown triggered, interrupt again to enter shutdown

When the license expires, Boundary performs a graceful shutdown. A graceful shutdown closes listeners and servers before shutting down the controller to preemptively stop any new traffic to the Boundary instance.

To update your license key, refer to the steps in Enable Boundary Enterprise. As a best practice, we recommend restarting the controller after you update the license key.

More information

Refer to the Upgrade and database migration tutorial for step-by-step instructions to upgrade Boundary to the latest version, including database backup and data migration.

Refer to Monitor Boundary for more information about configuring Boundary to monitor events.