Metering, entitlements & edge SDK

Every customer gets what they paid for. Even offline.

Count what customers use, check it against their plan in one place, and warn them before they hit the wall. On edge devices a signed entitlement keeps the rules working when the network does not.

Book a demo Device lifecycle

Usage this period · Vaarta AILive

Edge devicesWithin the plan limit

Metered unitWithin the plan limitPast the 80% alert line

This device's signed entitlement

ActiveGraceRestricted

The grace period is inside the signed token, so the device decides on its own when offline.

Why it matters

Limits that hold, even with no network

One answer to "is this allowed?"

Limits live in Identity Studio, not in scattered if-statements. Change a plan and every app sees it.

Devices decide on their own

A signed entitlement, verified offline, carries the plan, the limits and a signed grace period.

Usage counted once

Every usage record carries its own key, so a retry is never counted twice.

How it works

A device, from first boot to a plan it enforces

1AdminIssue a bootstrap tokenSingle use, hashed, valid 24 hours by default.
2DeviceRegisterIt waits as pending approval.
3AdminApproveThe device gets an RSA-2048 certificate (365 days) and its first entitlement.
4DeviceCheck limits offlinemay_add answers ok, at limit, over a soft limit or restricted.
5DeviceBuffer and flush usageRecorded locally with an idempotency key; sent in order, 100 at a time.
6Identity StudioSync and rotateA new entitlement when the plan changes or fewer than 7 days remain.

Capabilities

What the entitlement carries

Capability	Details	Status
Signed entitlement	RS256 from a per-application authority. Plan, dimensions (limit, used, reset, enforce), features, permissions and a signed grace period.	Live
States	Active, then grace, then restricted, decided on the device.	Live
Refusal reasons	Malformed, forged, wrong application, not yet valid, expired, stale, revoked.	Live
Idempotent usage	Stored on the device in SQLite first; the server dedupes on the idempotency key.	Live
Hard and soft limits	Each limit blocks (402) or warns.	Live
Alerts	Stages at 80, 90 and 100 percent of a limit.	Live
Overage policy per limit	Allow, notify, block, charge or meter.	Early access
Customer dashboards	Usage, allocations and the edge fleet in each customer's console.	Live
Generic for any edge app	Nothing names a dimension or unit; a census test fails on a hard-coded key; a conformance kit checks your integration.	Live

Configuration

Settings

Option	Values	Default
Bootstrap tokens	count 1 to 20 · expiry 1 to 720 hours	1 · 24 h
Limit per dimension	A number, or -1 for unlimited	per plan
hard_block	Block at the limit, or warn	block
grace_period_days	Signed into the entitlement	from the plan
rotate_before_days	When the device asks for a new certificate	30
edge_devices	Switch edge devices on for an app	off

Under the hood

What protects it

From the code

vaarta_edge/entitlement.pythe check on the device

def may_add(self, key, n=1, *, in_use=None, now=None):
    dim = self._dimension(key)
    if dim is None:
        return Decision(False, "not_in_plan")
    if self.state_at(now) == RESTRICTED:
        return Decision(False, "restricted", 0)
    left = self.remaining(key, in_use=in_use, now=now)
    if left is None:
        return Decision(True, "unlimited", None)
    if n <= left:
        return Decision(True, "ok", left)
    if str(dim.get("enforce") or HARD_BLOCK) == SOFT_WARN:
        return Decision(True, "over_soft_limit", left)
    return Decision(False, "at_limit", left)

Security notes

Offline verification accepts RS256 only.
The device pins the authority certificate it receives at sync.
Device-requested certificate rotations are audited, and fail if the audit row cannot be written.
Usage the server refused is kept as refused and never resent.

Works with

Part of one platform

Billing & plans The plan sets the limits.SDKs The edge package.Roles & permissions Device roles become permissions.

Which plans include it, and the limits that apply, are on the plans page.See plans →

Explore the platform

One platform, every piece of sign-in and access

Stop hard-coding limits

Move your first limit into Identity Studio and enrol a device.

Book a demo Start free trial