One environment variable unlocks paid plugins, same image, no sidecar.
Create an account and copy your license JWT from the License page in the dashboard.
Add ENV CMS_LICENSE_KEY=<jwt> to your Dockerfile (or set it as a container environment variable).
On boot, the engine verifies the JWT signature offline against an embedded Ed25519 public key, reads the entitled features[], and activates the matching plugins in-process.
A 7-day offline grace window keeps paid plugins active for one week past expiry, so a temporary outage of the issuance API never disables your stack.
FROM ghcr.io/lyeve/cms:latest # Activate the plugins your subscription entitles ENV CMS_LICENSE_KEY=<your-jwt> # Optional: only activate a subset of the entitled plugins # ENV CMS_PLUGINS=graphql,smtp
The customer image is the same for free and paid users. Paid plugin code is compiled in but stays inert without a valid license JWT.
| Plugin | What it adds | Monthly |
|---|---|---|
| plugin-graphql | GraphQL API generated from your schemas | $9 |
| plugin-grpc | gRPC + JSON-codec API for backend integrations | $9 |
| plugin-smtp | Outbound transactional email + lifecycle hooks | $5 |
| plugin-webhook | Outbound webhooks with retry + delivery log | $9 |
| plugin-s3 | S3 / R2 / MinIO storage backend | $9 |
| plugin-multitenant | Tenant-scoped routing and data isolation | $29 |
Volume discounts apply on the cart: 3 plugins → -15%, 5 plugins → -20%. The free engine (no key) ships REST, RBAC, schemas, multi-DB, and local file storage.
7-day offline grace: when the JWT expires, the engine honours the cached copy for up to 7 days. No downtime, no data loss, no phone-home.
On cancellation: paid plugins go inert after grace, no data is ever deleted. The engine keeps serving REST, RBAC, schemas, and storage.
Free tier always works: REST API, schema builder, RBAC, MFA, and webhooks-in are not gated by the license. They run forever without a key.
| Variable | Default | Description |
|---|---|---|
| CMS_LICENSE_KEY | none (free tier) | Ed25519-signed license JWT. Empty = engine runs without paid plugins. |
| CMS_PLUGINS | none (all entitled) | Comma-separated subset of plugins to activate. Must be a subset of the JWT `features[]`. |
| CMS_LICENSE_CACHE_DIR | /var/lib/cms | Writable directory where the JWT is cached for offline grace. Mount a volume here. |