The Warewolf subscription/licence is stored in a Warewolf License.secureconfig file. On the full Warewolf server this file lives in %programdata%\Warewolf\Server Settings and is written by Warewolf Studio when you register your Chargebee subscription. The Lightweight Execution Engine reads the same file format, but loads it from the engine’s bin directory (alongside the application binaries) because it is registered through the engine’s app.config as a configSource:
<configSections>
<section name="subscriptionSettings" type="System.Configuration.NameValueSectionHandler" />
</configSections>
<subscriptionSettings configSource="Warewolf License.secureconfig" />
If the file is missing, the engine treats the instance as a broken/unlicensed installation: the subscription Status resolves to a non-active default, so the engine is not licensed. While the license gate is enabled (the default — see WAREWOLF_LICENSE_CHECK_ENABLED below), every workflow execution is refused with a failure response (“Execution blocked: a valid Warewolf license/subscription is required.”) and the workflow does not run. This is a safe-by-default behaviour.
File format
The file is a small UTF-8 XML document. A single <subscriptionSettings> element contains one <add key="..." value="..." /> entry per setting. The recognised keys are:
| Key | Description |
CustomerId |
Chargebee customer ID. May be empty for a development/test licence. |
SubscriptionId |
Chargebee subscription ID. May be empty for a development/test licence. |
Status |
Subscription status. The engine considers the instance licensed only when this is Active or InTrial. Valid values: NotActive, Future, InTrial, Active, NonRenewing, Paused, Cancelled. |
PlanId |
The subscribed plan, e.g. developer. |
SubscriptionKey |
The Chargebee site API key used to refresh subscription state. |
SubscriptionSiteName |
The Chargebee site name, e.g. warewolf-test. |
StopExecutions |
true/false. A server-side flag (set when a subscription lapses) that halts executions independently of Status. |
Each value may be supplied as plain text or encrypted (see below). The engine auto-detects which form each value is in. Empty values (for example an unset CustomerId) are left as-is.
A plain-text test licence with Status=Active — the easiest form to author and review. This is the form Warewolf ships for testing.
<?xml version="1.0" encoding="utf-8"?>
<subscriptionSettings>
<add key="CustomerId" value="Customer ID for testing with" />
<add key="SubscriptionId" value="" />
<add key="Status" value="Active" />
<add key="PlanId" value="candice.daniel@dev2.co.za" />
<add key="SubscriptionKey" value="Dev2-test-account" />
<add key="SubscriptionSiteName" value="warewolf" />
<add key="StopExecutions" value="false" />
</subscriptionSettings>
A trial licence — Status=InTrial also counts as licensed, so executions are permitted.
<?xml version="1.0" encoding="utf-8"?>
<subscriptionSettings>
<add key="CustomerId" value="cust_abc123" />
<add key="SubscriptionId" value="sub_xyz789" />
<add key="Status" value="InTrial" />
<add key="PlanId" value="developer" />
<add key="SubscriptionKey" value="your-chargebee-api-key" />
<add key="SubscriptionSiteName" value="warewolf" />
<add key="StopExecutions" value="false" />
</subscriptionSettings>
A fully encrypted licence as produced for production — every non-empty value is an AES Base64 blob.
<?xml version="1.0" encoding="utf-8"?>
<subscriptionSettings>
<add key="CustomerId" value="" />
<add key="SubscriptionId" value="" />
<add key="Status" value="aT/AoVWEMyf6OPvaYp47Gw==" />
<add key="PlanId" value="qj2HmQwVsUt12btj/iXadA==" />
<add key="SubscriptionKey" value="ml420y+ZHMiv8CoQJxF1XMsYXXxCcDgNkvFkZSJHQB+m3EdlYIeUAP8oEIl9Z29b" />
<add key="SubscriptionSiteName" value="tWPn5xcpWET9NX3yt+uPHQ==" />
<add key="StopExecutions" value="r/EOk8xFEhRno3TYRCvIKQ==" />
</subscriptionSettings>
Encrypting the licence file
See https://warewolf.io/knowledge-base/articles/security-encryption/
Placing the file during deployment
The licence file must land in the engine’s application directory (next to the binaries) as Warewolf License.secureconfig — the exact name, including the space, matters because app.config references it by that literal name.
If you deploy with StartAsAzureFunction.ps1, pass your pre-built, encrypted file with -LicenseConfigPath; it is copied into the function directory for you. When the parameter is omitted, the script generates a test licence (Status=Active) so /IsLicensed returns true — convenient for smoke tests, but not for production:
.\StartAsAzureFunction.ps1 `
-LicenseConfigPath "C:\deploy\Warewolf License.secureconfig"
For a zip / CI-CD deploy, include the encrypted Warewolf License.secureconfig in the package root so it is unpacked alongside the engine binaries, e.g.:
az functionapp deploy `
--resource-group rg-warewolf-prod `
--name func-warewolf-prod `
--src-path warewolf-func.zip `
--type zip
You can confirm the licence loaded by calling the anonymous GET /IsLicensed endpoint, which returns the local status without contacting Chargebee:
{ "isLicensed": true, "status": "Active", "planId": "developer", "stopExecutions": false }
Engine configuration
| Variable | Required in Azure | Default | Description |
|---|---|---|---|
WAREWOLF_LICENSE_CHECK_ENABLED |
No | true |
Controls the per-execution licence gate. When unset or any value other than false/0, unlicensed instances refuse to run workflows. Set to false to disable the gate — development only. |
Unlike the Key Vault source-encryption feature, the licence file needs no environment variables to be read or decrypted — the engine loads and decrypts it at startup using its built-in key.
Troubleshooting
| Symptom | Likely cause | Fix |
| Every workflow returns “Execution blocked: a valid Warewolf license/subscription is required.” | Warewolf License.secureconfig is missing, or its Status is not Active/InTrial. |
Deploy a valid encrypted licence with Status=Active to the engine’s bin directory. For local testing only, set WAREWOLF_LICENSE_CHECK_ENABLED=false. |
/IsLicensed returns isLicensed: false |
Wrong Status, an expired subscription, or values mangled by double-encryption. |
Run Protect-LicenseConfig.ps1 -Decrypt -OutPath - to inspect the values; re-author and re-encrypt if needed. |
stopExecutions: true and executions are halted despite an active status |
The StopExecutions flag is set (typically after a lapsed/cancelled subscription). |
Resolve the subscription state, then set StopExecutions back to false and redeploy the licence file. |
| Plain-text licence works locally but reverts to unlicensed in Azure | The engine could not write the re-encrypted file back to a read-only app directory. | Pre-encrypt with Protect-LicenseConfig.ps1 -Encrypt before deploying so no runtime write is required. |
