# Licences, devices, and entitlement

Three separate objects: LICENCE (a plan on your account email) · DEVICE CERTIFICATE (a keypair minted on the machine at registration — sign-in at setup, or `kaptain device register` + one approval click) · LEASE (short-lived signed proof "this certificate is entitled to this plan", verified at every start, renewed in the background).

## Why three links
The key proves you bought something; the certificate proves THIS machine may use it; the lease makes revocation/expiry work without constant phoning home. Only a fingerprint HASH leaves the machine; approval codes and access codes are stored as hashes server-side.

## Offline
A current lease keeps working through outages; validation falls back to a signed local cache; nothing is re-entered after reconnecting. Diagnosis: `kaptain device status` / `kaptain license status` print which link is broken.

## Failure = 402, always with a one-step fix
Never bound / revoked / lease expired after long offline / moved hardware / trial ended / clock skew / below min version — the full table: https://chynj.ca/kaptain/docs/how-to/fix-402/ . Pro = 5 devices; free a slot in the portal.