How 0scp SaaS Contract licensing works

June 4, 2026 · The 0scp Team

0scp runs in your account but is billed through AWS Marketplace. So how does your in-account stack know it’s entitled to run? Here’s the full picture.

Subscription → license key

When you subscribe, Marketplace redirects you to our registration page with a one-time token. The seller-hosted licensing service resolves that token to your customer identity and reads your contract entitlement:

POST {seller}/register  (x-amzn-marketplace-token)
  → ResolveCustomer(token)        → CustomerIdentifier, ProductCode, account id
  → GetEntitlements(productCode)  → dimension, quantity, expiration
  → mint HMAC license key, persist

These Marketplace APIs only work from the seller account in us-east-1, which is exactly why licensing is a separate service your stack merely calls.

Runtime validation

Your stack validates the key on a schedule:

GET {seller}/v1/license/validate?licenseKey=...&accountId=...
  → { valid, status, dimension, quantity, expiresAt }

Results are cached and the check fails open during a transient outage — a brief seller-side hiccup never disables your guardrails.

The read-only degrade

Status	Behavior
ACTIVE	Full platform
EXPIRED / SUSPENDED	Read-only — writes return `402`

The degrade is non-destructive: guardrails you already enforced stay in place. Renew in Marketplace and an SNS event restores ACTIVE automatically.

Want the details? See Licensing & Entitlement.