Stood Flows is unlocked by a per-folder licence key. The key gates the Refresh action and any analysis that triggers fresh org reads; it does not gate browsing data you've already pulled. If you have a graph with versioned snapshots on disk, you can keep opening, exploring, and exporting from it indefinitely with or without a valid key.
A key is a short JWT-style token signed with a private Ed25519 key Hway Digital holds. The payload says, in plain English: "this licence covers org alias X and is valid until Y". The desktop app carries the matching public key embedded in its binary and verifies signatures offline — no network call, no phone-home.
One key per folder, stored at:
~/StoodFlows/workspaces/<folderAlias>/license.key
The folder alias is the name you give a workspace when you create it (typically the org alias, e.g. meridian, acme-prod). You can drop the file in place manually or use the in-app entry described below.
Two equivalent paths:
From the folder picker: when you open a folder without a valid key, the app shows an unlock prompt — paste the key and confirm.
From the gear icon → Global Settings → Licence: paste the key into the matching folder's row and confirm.
In both cases the app:
Verifies the Ed25519 signature against the embedded public key.
Checks that the folder alias matches the orgs array in the payload.
Checks the expiry timestamp.
Writes the key to license.key on success, surfaces a red error on failure.
A successful unlock is sticky for that folder until the key expires.
Action | Needs a key? |
Open a folder, browse existing versions | No |
KPI table, Volumes, Complexity, Apex, Licensing, DML, I/O panels on cached data | No |
Refresh backbone | Yes |
Fetch Apex bodies + dependency tree | Yes |
Fetch Event Log Files (DML and I/O analyses' first run on a new period) | Yes |
Run a Usage analysis (creator / modifier counts) | Yes |
Export / package generation (works from cached data) | No |
The rule of thumb: anything that calls sf against the org needs a valid key.
Keys are time-bound. As expiry approaches, the app shows an amber notice in the folder header. Once expired, refreshes are blocked; cached analyses remain readable. Drop a new key into license.key or paste it in Global Settings to extend.
Each folder has its own key file. A key issued for meridian will not unlock acme-prod. If you analyse N orgs, you'll typically have N keys, each scoped to one folder. The cost model is a per-org subscription — when in doubt, ask whoever issued the licence.
Keys are issued by Hway Digital. Contact information and pricing are on https://stoodcrm.com. The short version: send the org alias you intend to use, get back a .key file or a token string.
It is not a way for Hway Digital to read your data. The verification is local-only, signed with asymmetric crypto, and the app never opens a network connection just to validate.
It is not tied to a particular machine, user account, or installation. Move the .key file between machines and it keeps working until expiry.
It is not a kill switch. Once a refresh is on disk, that analysis stays accessible forever — keys gate fresh reads, not historical inspection.