Stood Flows is unlocked by a per-folder licence key. The key gates the Refresh action and any analysis that triggers fresh org reads; it does not gate browsing data you've already pulled. If you have a graph with versioned snapshots on disk, you can keep opening, exploring, and exporting from it indefinitely with or without a valid key.
A folder's role is something you choose in its Settings, not something the key decides for you:
Admin — you refresh graphs from the org and publish the results. This is the role that needs a key, because refreshing is the licensed action. It needs one even for a folder you never share with anyone.
Contributor — you read the analysis and work on issues. No key needed.
Choosing Admin without a valid key doesn't make the buttons disappear. They stay visible and greyed, and the tooltip tells you whether the key is missing, expired, or issued for a different org.
See Sharing and roles for the full picture, and Settings for where keys are entered.
A key is a short JWT-style token signed with a private Ed25519 key Hway Digital holds. The payload says, in plain English: "this licence covers org X and is valid until Y". The desktop app carries the matching public key embedded in its binary and verifies signatures offline — no network call, no phone-home.
One key per folder, stored at:
~/StoodFlows/workspaces/<folderAlias>/license.key
The folder alias is the name you give a workspace when you create it (typically the org alias, e.g. meridian, acme-prod). You can drop the file in place manually or use the in-app entry described below.
Two equivalent paths:
From the folder's Settings: choose the Admin role and paste the key into the licence field that appears.
From the gear icon → Global Settings → Licence: paste the key into the matching folder's row and confirm.
In both cases the app:
Verifies the Ed25519 signature against the embedded public key.
Checks the expiry timestamp.
Checks that the folder's Salesforce Org ID is one the licence covers.
Writes the key to license.key on success, surfaces a red error on failure.
A successful unlock is sticky for that folder until the key expires.
A folder that has never been refreshed doesn't know its Org ID yet, so there is nothing to check the licence against. Stood Flows accepts the key and tells you the org will be bound on the first refresh — otherwise you'd need a refresh to validate the key and a valid key to refresh. From the second validation onwards the Org ID check applies normally.
Action | Needs a key? |
Open a folder, browse existing versions | No |
KPI table, Volumes, Complexity, Apex, Licensing, DML, I/O panels on cached data | No |
Pull a shared analysis from S3, and push issues back | No |
Refresh backbone | Yes |
Fetch Apex bodies + dependency tree | Yes |
Fetch Event Log Files (DML and I/O analyses' first run on a new period) | Yes |
Run a Usage analysis (creator / modifier counts) | Yes |
Publish an analysis to S3 | Yes |
Export / package generation (works from cached data) | No |
The rule of thumb: anything that calls sf against the org needs a valid key.
Keys are time-bound. As expiry approaches, the app shows an amber notice in the folder header. Once expired, refreshes are blocked; cached analyses remain readable. Drop a new key into license.key or paste it in Global Settings to extend.
Each folder has its own key file, and each key covers specific Salesforce orgs. A key issued for one org will not unlock a folder pointed at a different one, whatever you have named the folders locally. If you analyse N orgs, you'll typically have N keys. The cost model is a per-org subscription — when in doubt, ask whoever issued the licence.
Keys are issued by Hway Digital. Contact information and pricing are on https://stoodcrm.com. The short version: send the org you intend to analyse, get back a .key file or a token string.
It is not a way for Hway Digital to read your data. The verification is local-only, signed with asymmetric crypto, and the app never opens a network connection just to validate.
It is not tied to a particular machine, user account, or installation. Move the .key file between machines and it keeps working until expiry.
It is not a kill switch. Once a refresh is on disk, that analysis stays accessible forever — keys gate fresh reads, not historical inspection.