Keys

Keys is the foundation the other services stand on. Recovery, licensing, and server-locking each need a key, and this is where you create and store them — in an encrypted vault, protected by one password, that never leaves your machine.

Keys are managed in the Desktop app. The CLI uses keys you’ve already created; the vault itself lives in Desktop.

Public vs private — the one thing to understand

Two of the three key types are keypairs: a matched pair of 64-character hex values, where the two halves do opposite jobs.

The private key stays with you. It’s the secret half — it signs your licenses, or recovers your files. If you lose it, no one (including Oxrion) can do those things for you; if someone else gets it, they can. Guard it.

The public key goes out. It’s the half that gets embedded into your protected files when you encode. On its own it can’t sign or recover anything — it only lets a protected file check work the private key did, so it’s safe to share.

A simple way to hold it: private does the work, public only verifies it. You keep the private half; the public half ships inside your code.

The three kinds of keys

Recovery keypair

Lets you turn a protected file back into source later.

Half	Length	What it does
Private key	64	Recovers your files. Keep it safe and offline.
Public key	64	Embedded when encoding, so a file can be recovered by the matching private key.

Use it: create the keypair here, then turn on Recovery in the Encoder and bind this key. Later, Recovery uses the private half to restore your source.

License keypair

Lets you issue licenses that your protected code will trust.

Half	Length	What it does
Private key	64	Signs the licenses you create in the Licenser.
Public key	64	Sent to Oxrion to be certified, then embedded when encoding — so the file trusts licenses signed by your private half.

Use it: create the keypair here, turn on Bind to a license in the Encoder (paste the public key), and sign .lic files with the private key in the Licenser.

External key (server lock)

Not a keypair — a single secret with an ID and a value. Code protected with this key only runs on a server where the matching key is present in the environment.

Part	Length	What it is
Value	64	The secret. Generate a random one or paste your own.
ID	—	Shown after you enter the value. It names the environment variable the server reads.

How it works at runtime: when you protect code with Server lock enabled, the file is bound to this key. To run it, the target server must expose the key as an environment variable named OXRION_EXTERNAL_KEY_<id>:

OXRION_EXTERNAL_KEY_95867194943b3037ab0863e400e74686=e7071d29692322f80331fd850876a54e930ffedfbc3477a13b2e388ea0abd6b1

Set it wherever your server reads environment variables (php-fpm pool config, the web server, a .env the app loads, a container’s env). Without it, the code won’t run — which is the point: your code runs only where you placed the key.

Use it: create the key here, turn on Server lock in the Encoder, and set OXRION_EXTERNAL_KEY_<id> on the server that should run the code.

Keep them safe

Your keys are the only things that can recover your source or issue valid licenses. Back up the vault, remember the password, and never share a private key. Oxrion cannot recover them for you — that independence is the point.

To see the vault and add-key screens, see Using the app.