Licensing and editions

O3O Office Online comes in two editions on the same installation: a free community edition and an enterprise edition priced per connection. Upgrading needs no reinstall: just load a license token.

How the editions differ#

Every limit in detail: Plan limits. How connections are counted: How connections are counted.

Loading the license token#

The gate and DocBuilder read the token in this order: the O3O_LICENSE_TOKEN variable when not empty, then the O3O_LICENSE_FILE file (default /etc/o3o/license.token) when it exists, otherwise no token (community edition). Leading and trailing whitespace is trimmed. The file is re-read every 60 seconds, so replacing it needs no restart; changing the environment variable requires recreating the container.

1. Put the token in place

   Either paste it into O3O_LICENSE_TOKEN in online/.env, or save it as a file mounted into both o3o-gate and o3o-docbuilder at /etc/o3o/license.token.

2. Load it

   With the environment variable: docker compose ... up -d. With the file: wait up to 60 seconds.

3. Check

   GET /o3o/status must show license.state = "valid", edition = "enterprise" and connections.limit equal to the purchased connections; GET /v1/limits must show edition = "enterprise".

# Option 1: environment variable in online/.env (token shortened for readability)
O3O_LICENSE_TOKEN=eyJ2IjoxLCJrZXkiOiJPT1NZLTdLMk05LVE0WEJDLUQ4SEpOLVIzVFdaIiwicGxhbiI6InllYXIiLCJwcm9kIjoibzNvLW9ubGluZSIs...base64...==.W2m7...base64...==

# Option 2: a file; leave O3O_LICENSE_TOKEN empty
O3O_LICENSE_TOKEN=
O3O_LICENSE_FILE=/etc/o3o/license.token

# Check after loading
curl -s http://localhost:8080/o3o/status | jq '{edition, license: .license.state, limit: .connections.limit}'
curl -s http://localhost:8080/v1/limits -H "Authorization: Bearer O3O_DEMO_KEY" | jq .edition

# docker/compose.license.yml, use with: -f docker/compose.dev.yml -f docker/compose.license.yml
# ./license.token is relative to the first compose file's folder (online/docker/)
services:
  o3o-gate:
    volumes:
      - ./license.token:/etc/o3o/license.token:ro
  o3o-docbuilder:
    volumes:
      - ./license.token:/etc/o3o/license.token:ro

Token format#

A token is base64(payload_json) + "." + base64(signature): standard Base64 with = padding (alphabet +/), exactly one dot, and an Ed25519 signature over the exact payload bytes. The gate and DocBuilder verify it with the O3O license server's public key (O3O_LICENSE_PUBKEY). Unknown payload fields are ignored.

{
  "v": 1,
  "key": "OOSY-7K2M9-Q4XBC-D8HJN-R3TWZ",
  "plan": "year",
  "prod": "o3o-online",
  "mid": "",
  "cust": "Công ty TNHH An Phát",
  "exp": "2027-09-30",
  "upd": "2027-10-07",
  "iat": 1790000000,
  "lid": 123,
  "kind": "enterprise",
  "conns": 200,
  "feat": [
    "api_full",
    "callback"
  ]
}

Token states#

Working offline#

• The token is verified entirely OFFLINE with the Ed25519 public key in the configuration; your O3O server does not call office.o3o.vn and sends usage data nowhere.
• A server on an isolated network gets the full enterprise edition until exp, plus 7 days of grace for annual plans.
• Perpetual licenses never expire; update rights end at upd: images built before that date keep accepting the token forever.
• To bind a token to exactly one server, request a token whose mid equals the instance_id from /o3o/status. When you use an instance-bound token, set O3O_GATE_INSTANCE_ID explicitly in .env so the gate and DocBuilder share the same id; scripts/gen-secrets.sh (or gen-secrets.ps1) generates it when it creates a new .env.

Renewing and adding connections#

O3O signs and delivers a new token once the order is complete. Replace the token the same way you loaded it; the gate picks it up within 60 seconds (file) or after the container is recreated (environment variable). Open sessions are not affected.

Price summary#

Prices are listed in USD. The unit price applies to ALL connections of the order (not progressive by tier). Minimum 50 connections per order. Perpetual licenses include 3 years of updates.

Never-more-expensive rule#

charged(n) = min(m × unit_price(m)) over every m ≥ n and m ≥ 50. When the cheapest price falls on m > n, the customer pays for m and IS GRANTED m connections. Buying more therefore never costs more at a tier boundary.

The invoice states, and the token grants, exactly the connection count of the level that is billed, not the number entered. Annual example: choosing 190 connections bills 201 connections × 4.5 USD = 904.5 USD, and the token carries conns = 201.

Paying in VND: the USD to VND exchange rate is fixed and stored when the order is CREATED; the payment QR code keeps that exact amount. If an order expires unpaid, create a new order, priced at the exchange rate when the new order is created.