---
title: "Security & Licensing"
id: "1718"
type: "page"
slug: "licensing"
published_at: "2026-09-20T20:36:26+00:00"
modified_at: "2026-09-21T01:36:28+00:00"
url: "https://xedant.com/agents/multiagent/docs/licensing"
markdown_url: "https://xedant.com/agents/multiagent/docs/licensing.md"
excerpt: "MultiAgent holds the sensitive data of your whole infrastructure: servers’ SSH keys, agent passwords, registry…"
---

# Security & Licensing

[https://xedant.com/agents/multiagent/docs/licensing.md](https://xedant.com/agents/multiagent/docs/licensing.md)

MultiAgent holds the sensitive data of your whole infrastructure: servers’ SSH keys, agent passwords, registry tokens and API keys. This page explains how all of it is protected, how backups are set up, and how licensing works.

## Secret encryption

Every secret is encrypted at rest with AES-256-GCM symmetric encryption. The 32-byte key lives in `/data/keys/management-secret.key` — inside the MultiAgent volume, outside the database. What is protected:

- servers’ SSH passwords and private keys (including proxy jump credentials);
- Postgres and Forgejo passwords on servers;
- image registry tokens (Registry Auth);
- agent managers’ passwords and the secret variables of models and tools;
- API keys and server service passwords (Postgres, Forgejo, central login, backup).

User sign-ins are checked with JWT tokens valid for 90 days, signed by a separate key from `/data/keys`. Every API action requires a key check; only the login page is anonymous, and the machine interface `/api/agent/*` opens with its own `X-API-Key`.

## Agent API — the machine interface

The `/api/agent/*` interface is meant for automatic calls — from agents and external systems. Every request is checked against the `X-API-Key` header: the `MULTIAGENT_API_KEY` environment variable stores only the key’s fingerprint (a SHA-256 hash), and the key itself is set once at install. Without the variable, the interface answers 503 and does not work at all.

Security details: `GET /api/agent` returns a catalog of every operation with descriptions; secrets can only be written — they are never given back, only “has a value” hints; there is no remote code execution — only pre-defined operations; long operations follow the “start it, then poll” pattern at `operations/{id}`. Details — [Agent API](/agents/multiagent/docs/agent-api)
.

## Backups

On every server MultiAgent runs an rsyncd container — a small backup service — with seven read-only modules: the docker, home, data, projects and tools folders, plus two dump folders. Your backup machines pull the data by rsync on a schedule — a typical nightly task:

```
# nightly backup of all server data
rsync -avz rsync://backup@server-host:873/data/    /backups/server-host/data/
rsync -avz rsync://backup@server-host:873/projects/ /backups/server-host/projects/
```

MultiAgent itself is backed up together with its `/data` volume: the database, the encryption keys and the license live there. More about the data layout — in the [installation guide](/agents/multiagent/docker)
.

## Agent licenses

The “Licenses” section is the central store for Xedant Agent family license keys. A key is verified when added, encrypted at rest, and never returned by the API — the interface shows only the parsed metadata (type, owner, term, covered products) and never the key itself. The licenses page and the details dialog show a **“Products”** field: the list of products from the key, or “Universal” for a universal key. A correctly signed key that does not cover the product you need returns a coverage error instead of a term — the status tells you exactly what is wrong. One key can be assigned to any number of agents and lands automatically in their `AGENT_LICENSE` variable at deployment. A license assigned to at least one agent cannot be deleted until you detach it.

## MultiAgent licensing

MultiAgent itself ships with a 30-day trial baked into the image. The license is a self-contained signed string: you load it through the `AGENT_LICENSE` variable (the same one every product in the family reads) or as an activation file in the data folder, and it is verified offline against a built-in key. A universal key (no product list) covers every product; an invalid license blocks only creating new things and sending messages. License types and prices — on the [Licensing](/agents/multiagent/license)
 page.

[← Back to documentation](/agents/multiagent/docs)