A 3B license is a signed token provided by Tines. It starts with 3bl_v1_ and applies to a tenant. Self-hosted deployments currently contain one tenant, so you apply one token to the installation. Tines Support or your account team will send you the token.
Paste it as a single line, with no extra spaces or line breaks.
The installation stores the token on the tenant during the tenant bootstrap job. Each flow below runs that job after updating the protected configuration.
Single-server install (k3s)
Use these steps if you installed 3B with the single-server installer (setup.sh on the host).
Fresh install
On first run the installer asks for the signed 3B license token. Paste the 3bl_v1_… token from Tines when prompted.
Apply or renew a license
Step 1. Set the license. Save the token from Tines in a file readable only by the installer, or open /opt/3b/.env and set LICENSE directly:
LICENSE=3bl_v1_…
Step 2. Re-run setup. If you saved the token in a file, pass its absolute path:
sudo bash /opt/3b/setup.sh --license-file /path/to/license
If you set LICENSE in .env, run:
sudo bash /opt/3b/setup.sh
The installer stores the token in its protected configuration, updates the Kubernetes secret, and applies it to the tenant. The file is no longer needed after setup completes.
The same steps work on an air-gapped server. License verification is local and does not require an outbound connection.
Step 3. Confirm. Open the 3B UI in a browser. The license message should be gone and the app should load as usual.
Kubernetes (Helm)
Use these steps if you installed 3B with the Helm chart on your own cluster.
The chart stores the license on the license key of the api-secrets secret and applies it to the tenant through the tenant bootstrap job. The default namespace is 3b; replace <namespace> if you installed into a different one.
Helm manages secrets
Follow these steps if your values file has secrets.generate: true (the default).
Step 1. Set the license in values. Open your Helm values file and set:
license: "3bl_v1_…"
Step 2. Upgrade the release:
helm upgrade 3b oci://oci.tines.com/3b/charts/3b --version <VERSION> \ --namespace <namespace> -f values.yaml
The upgrade waits for its post-upgrade tenant bootstrap hook to apply the license.
Step 3. Confirm. Open the 3B UI in a browser. The license message should be gone and the app should load as usual.
Secrets are managed outside Helm
Follow these steps if your values file has secrets.generate: false. In this case, the license field in Helm values is ignored.
Step 1. Update the secret:
kubectl -n <namespace> patch secret api-secrets --type merge \
-p '{"stringData":{"license":"3bl_v1_…"}}'
If you store the token in an external secret manager, update it there instead and wait until api-secrets shows the new value.
Step 2. Run tenant bootstrap. Re-run the Helm upgrade with the same chart version and values after the external secret has synchronized:
helm upgrade 3b oci://oci.tines.com/3b/charts/3b --version <VERSION> \ --namespace <namespace> -f values.yaml
The upgrade waits for its post-upgrade tenant bootstrap hook to apply the license.
Step 3. Confirm. Open the 3B UI in a browser. The license message should be gone and the app should load as usual.