Skip to main content

Seats and devices

Obfy is licensed per developer seat. Each seat lets a developer run obfy build from their machines. This is separate from the license file that binds a protected dist to expiry or hardware.

How seats work​

  • A seat corresponds to a member of your organization.
  • obfy login signs you in; obfy register then claims a device slot for that machine against your seat. obfy build is gated on this — an unauthorized machine is refused.
  • A seat allows a limited number of developer machines (so you can work from a laptop and a desktop). When you hit the limit, revoke an old device from the dashboard before adding a new one.
  • Your organization's total seat count comes from your subscription. Adding more developers means adding seats.

Authorize a machine (online)​

obfy login      # browser-based device-code sign-in
obfy register   # claim a seat slot for this machine
obfy whoami     # confirm who you're signed in as
obfy logout     # forget cached credentials on this machine

Authorize an air-gapped machine (offline)​

For a build machine with no network access, use the offline (mode B) flow. It relies on a short-lived signed activation file verified entirely on-device — no phone-home at build time.

# On the air-gapped machine:
obfy register --offline      # prints this machine's fingerprint

Copy the printed fingerprint to a machine with network access, open the Obfy portal, choose Offline activation, paste the fingerprint, and download the activation file. Bring that file back to the air-gapped machine:

obfy activate ./obfy-activation.txt   # verifies signature, expiry, and that the
                                      # file is bound to this machine

obfy build then runs on that machine with no network connection until the activation expires (30 days), at which point you re-issue a fresh file the same way. The activation is bound to the machine fingerprint, so it cannot be reused on another host.

Manage devices​

Registered devices appear in the Obfy portal under Devices, where you can see each machine, when it was last seen, and revoke any you no longer use.

CI builds​

Continuous-integration builds should not consume a developer machine slot. Register the build agent as a CI token instead:

obfy register --ci --name "github-actions"

CI tokens are allocated per seat based on your plan tier. A CI token authorizes unattended obfy build runs without taking one of your interactive developer device slots.

Keep CI credentials secret

Treat the CI token like any other build secret — store it in your CI provider's encrypted secrets, never in the repository.