An enterprise license key unlocks Qyra Enterprise Edition features on a self-hosted instance. The key on its own enables nothing: each feature has its own environment flag, and you turn on only the ones you use. This page covers getting and applying the key, then each feature — the ones that need a flag or two are enabled right here, and the larger ones (AI agents, data apps, AI writeback, MCP, and pre-aggregates) each have a dedicated setup page linked from their section.

Get a license key

1. Contact the enterprise team — schedule a call to discuss your requirements.
2. Receive your key — the Qyra team will share the key with you, typically via 1Password.

Apply the license key

Set QYRA_LICENSE_KEY on every Qyra container: backend, scheduler, and workers.

QYRA_LICENSE_KEY=your-enterprise-license-key-here

Restart every container after adding the key.

License validation and network requirements

On server start, Qyra validates the license key by making an outbound HTTPS request to the Keygen license validation API:

• Endpoint: https://api.keygen.sh
• Purpose: validates the key provided in QYRA_LICENSE_KEY
• When: on every Qyra server start

No external code is pulled during validation — the request only checks the key and returns the result. For the exact request payload and how it fits into the broader self-hosted network picture, see Data flows and telemetry — Enterprise license validation.

Verify the license

After applying the key and restarting:

1. Log in as an admin user.
2. Open Settings → Organization.
3. Confirm the Enterprise Edition badge is present.

Features

AI agents

AI Analyst and AI agents bring natural-language querying, AI-generated charts, and agents that answer questions in-app and in Slack. Set AI_COPILOT_ENABLED=true and configure a model provider — see AI agents. Every other AI feature below assumes this one is enabled first.

Data apps

Data apps are AI-generated React apps, built inside an isolated sandbox and served from an S3-compatible bucket. Set APPS_RUNTIME_ENABLED=true with a sandbox provider, a model provider, and a bucket — see data apps.

AI writeback

AI writeback lets an agent edit the dbt repository behind a project and open a pull request with the change. Configure the writeback sandbox and its Anthropic key — see AI writeback.

MCP

Qyra can expose a Model Context Protocol server at /api/v1/mcp for AI assistants to query the semantic layer. Set MCP_ENABLED=true — see MCP for connecting assistants and network requirements.

Multi-agent Slack channels

Beta Multi-agent Slack channels let one Slack channel host every AI agent in the organization, with the AI Router picking the best-fit agent per question. Requires AI agents and the Slack integration. Set:

SLACK_MULTI_AGENT_CHANNEL_ENABLED=true

Restart the backend, then designate the channel from the AI Agents organization settings — see setting up a multi-agent Slack channel for the in-app steps.

Embedding

Embedding renders Qyra dashboards, charts, data apps, and AI agents inside your own product, authenticated with a JWT signed by an embed secret. Set:

EMBEDDING_ENABLED=true
QYRA_IFRAME_EMBEDDING_DOMAINS=https://app.example.com,https://reports.example.com

QYRA_IFRAME_EMBEDDING_DOMAINS is the comma-separated allow-list of origins (protocol included, no trailing slash) permitted to iframe Qyra — if an embed URL loads on its own but the iframe stays blank, the host origin is missing from this list. Restart the backend, then generate an embed secret from Project settings → Embed configuration. The embedding variables reference covers the optional settings, including the embed event system.

Pre-aggregates

Pre-aggregates materialize aggregated tables to S3 and route matching queries to DuckDB instead of your warehouse. They need NATS, an S3-compatible bucket, and a dedicated worker deployment alongside the flag — see pre-aggregates.

Custom roles

Custom roles let organization admins define roles with a chosen set of permission scopes, beyond the built-in Admin, Developer, Editor, and Viewer roles. Set:

CUSTOM_ROLES_ENABLED=true

Restart the backend. Admins can then build and assign roles from Organization settings → Roles.

Service accounts

Service accounts are userless, scoped credentials for CLI and API access that outlive their creator. Set:

SERVICE_ACCOUNT_ENABLED=true

Restart the backend. Admins can then create and rotate tokens from Organization settings → Service accounts.

SCIM

SCIM 2.0 automates user and group provisioning from an identity provider such as Okta, Azure AD, or OneLogin. Set:

SCIM_ENABLED=true

When SCIM runs alongside SSO, also set AUTH_ENABLE_OIDC_TO_EMAIL_LINKING=true — without it, Qyra tries to create a new user on SSO sign-in and fails because the email is already taken by the SCIM-provisioned user. Restart the backend, then follow SCIM integration for the provider-side setup.

Enterprise SSO providers

SSO providers such as Google Workspace are available on all plans, but Okta, Azure AD, OneLogin, generic OIDC, Snowflake OAuth, and Databricks OAuth require the license key on self-hosted instances — see Configure SSO for self-hosted Qyra for the full setup.

Troubleshooting

If enterprise features are unavailable after applying the key:

1. Confirm QYRA_LICENSE_KEY is set on every Qyra container (backend, scheduler, workers).
2. Confirm every container was restarted after adding the key.
3. Confirm the per-feature environment flag is set (for example, AI_COPILOT_ENABLED=true for AI Analyst).
4. Confirm the server can reach https://api.keygen.sh.
5. Check the Qyra logs for license-related errors.
6. Contact enterprise support if the issue persists.

Related documentation

• Enterprise on-prem setup
• Production deployment checklist
• Environment variables reference
• Configure SSO for self-hosted Qyra
• Qyra Cloud vs. self-hosted