> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lightdash.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Enterprise features

> Enable Enterprise Edition features on a self-hosted Lightdash instance

<Note>
  🛠 This page is for engineering teams self-hosting their own Lightdash instance. If you want to learn about enterprise features and pricing, go to [lightdash.com/pricing](https://lightdash.com/pricing).
</Note>

An enterprise license key unlocks Lightdash Enterprise Edition features on a self-hosted instance. The key on its own enables nothing: each feature has its own environment flag, and you turn on only the ones you use. This page covers [getting](#get-a-license-key) and [applying](#apply-the-license-key) the key, then each feature — the ones that need a flag or two are enabled right here, and the larger ones ([AI agents](#ai-agents), [data apps](#data-apps), [AI writeback](#ai-writeback), [MCP](#mcp), and [pre-aggregates](#pre-aggregates)) each have a dedicated setup page linked from their section.

## Get a license key

1. **Contact the enterprise team** — [schedule a call](https://calendly.com/lightdash-cloud/enterprise?utm_source=docs\&utm_medium=referral\&utm_campaign=enterprise_licensing\&utm_content=license_key_page) to discuss your requirements.
2. **Receive your key** — the Lightdash team will share the key with you, typically via 1Password.

## Apply the license key

Set `LIGHTDASH_LICENSE_KEY` on **every** Lightdash container: backend, scheduler, and workers.

<Tabs>
  <Tab title="Environment variable">
    ```bash theme={null}
    LIGHTDASH_LICENSE_KEY=your-enterprise-license-key-here
    ```
  </Tab>

  <Tab title="Helm (Kubernetes)">
    ```yaml theme={null}
    secrets:
      LIGHTDASH_LICENSE_KEY: your-enterprise-license-key-here
    ```

    Then update your deployment:

    ```bash theme={null}
    helm upgrade lightdash lightdash/lightdash -n lightdash -f values.yaml
    ```
  </Tab>

  <Tab title="Docker Compose">
    ```yaml theme={null}
    services:
      lightdash:
        environment:
          - LIGHTDASH_LICENSE_KEY=your-enterprise-license-key-here
    ```
  </Tab>
</Tabs>

Restart every container after adding the key.

## License validation and network requirements

On server start, Lightdash validates the license key by making an outbound HTTPS request to the [Keygen](https://keygen.sh) license validation API:

* **Endpoint:** `https://api.keygen.sh`
* **Purpose:** validates the key provided in `LIGHTDASH_LICENSE_KEY`
* **When:** on every Lightdash server start

<Note>
  Your Lightdash instance must be able to reach `https://api.keygen.sh` on server start. This is the only external network request **required** to run Lightdash with enterprise features. If your environment restricts outbound traffic, allow-list this endpoint in your firewall or proxy.

  If you also enable the optional [organization roadmap](/self-host/customize-deployment/organization-roadmap), the backend makes outbound requests to `https://roadmap.lightdash.com` — allow-list that domain too.
</Note>

No external code is pulled during validation — the request only checks the key and returns the result.

## Verify the license

After applying the key and restarting:

1. Log in as an admin user.
2. Open **Settings → Organization**.
3. Confirm the **Enterprise Edition** badge is present.

## Features

### AI agents

[AI Analyst and AI agents](/agents) bring natural-language querying, AI-generated charts, and agents that answer questions in-app and in Slack. Set `AI_COPILOT_ENABLED=true` and configure a model provider — see [AI agents](/self-host/enterprise-features/ai-agents). Every other AI feature below assumes this one is enabled first.

### Data apps

[Data apps](/data-apps) are AI-generated React apps, built inside an isolated sandbox and served from an S3-compatible bucket. Set `APPS_RUNTIME_ENABLED=true` with a sandbox provider, a model provider, and a bucket — see [data apps](/self-host/enterprise-features/data-apps).

### AI writeback

<Badge icon="flask" color="purple" size="sm" shape="pill">Beta</Badge> [AI writeback](/agents/ai-writeback) lets an agent edit the dbt repository behind a project and open a pull request with the change. Enable the `ai-writeback` feature flag and configure the writeback sandbox and its Anthropic key — see [AI writeback](/self-host/enterprise-features/ai-writeback).

### MCP

Lightdash can expose a [Model Context Protocol server](/agents/lightdash-mcp) at `/api/v1/mcp` for AI assistants to query the semantic layer. Set `MCP_ENABLED=true` — see [MCP](/self-host/enterprise-features/mcp) for connecting assistants and network requirements.

### Multi-agent Slack channels

<Badge icon="flask" color="purple" size="sm" shape="pill">Beta</Badge> [Multi-agent Slack channels](/agents/set-up-agents#slack-channels-single-agent-vs-multi-agent) let one Slack channel host every AI agent in the organization, with the [AI Router](/agents/enable-ai-router) picking the best-fit agent per question. Requires [AI agents](#ai-agents) and the [Slack integration](/self-host/customize-deployment/configure-a-slack-app-for-lightdash). Set:

```bash theme={null}
SLACK_MULTI_AGENT_CHANNEL_ENABLED=true
```

Restart the backend, then designate the channel from the **AI Agents** organization settings — see [setting up a multi-agent Slack channel](/agents/set-up-agents#setting-up-a-multi-agent-slack-channel) for the in-app steps.

### Embedding

[Embedding](/embed/set-up-embedding) renders Lightdash dashboards, charts, data apps, and AI agents inside your own product, authenticated with a JWT signed by an embed secret. Set:

```bash theme={null}
EMBEDDING_ENABLED=true
LIGHTDASH_IFRAME_EMBEDDING_DOMAINS=https://app.example.com,https://reports.example.com
```

`LIGHTDASH_IFRAME_EMBEDDING_DOMAINS` is the comma-separated allow-list of origins (protocol included, no trailing slash) permitted to iframe Lightdash — if an embed URL loads on its own but the iframe stays blank, the host origin is missing from this list. Restart the backend, then generate an embed secret from **Project settings → Embed configuration**. The [embedding variables reference](/self-host/customize-deployment/environment-variables#embedding) covers the optional settings, including the embed event system.

### Pre-aggregates

[Pre-aggregates](/semantic-layer/pre-aggregates) materialize aggregated tables to S3 and route matching queries to DuckDB instead of your warehouse. They need NATS, an S3-compatible bucket, and a dedicated worker deployment alongside the flag — see [pre-aggregates](/self-host/enterprise-features/pre-aggregates).

### Custom roles

[Custom roles](/workspace-admin/custom-roles) let organization admins define roles with a chosen set of permission scopes, beyond the built-in Admin, Developer, Editor, and Viewer roles. Set:

```bash theme={null}
CUSTOM_ROLES_ENABLED=true
```

Restart the backend. Admins can then build and assign roles from **Organization settings → Roles**.

### Service accounts

[Service accounts](/workspace-admin/service-accounts) are userless, scoped credentials for CLI and API access that outlive their creator. Set:

```bash theme={null}
SERVICE_ACCOUNT_ENABLED=true
```

Restart the backend. Admins can then create and rotate tokens from **Organization settings → Service accounts**.

### SCIM

[SCIM 2.0](/workspace-admin/sso/scim) automates user and group provisioning from an identity provider such as Okta, Azure AD, or OneLogin. Set:

```bash theme={null}
SCIM_ENABLED=true
```

When SCIM runs alongside SSO, also set `AUTH_ENABLE_OIDC_TO_EMAIL_LINKING=true` — without it, Lightdash tries to create a new user on SSO sign-in and fails because the email is already taken by the SCIM-provisioned user. Restart the backend, then follow [SCIM integration](/workspace-admin/sso/scim) for the provider-side setup.

### Enterprise SSO providers

SSO providers such as Google Workspace are available on all plans, but Okta, Azure AD, OneLogin, generic OIDC, Snowflake OAuth, and Databricks OAuth require the license key on self-hosted instances — see [Configure SSO for self-hosted Lightdash](/self-host/customize-deployment/use-sso-login-for-self-hosted-lightdash) for the full setup.

<Tip>
  For the exhaustive list of environment variables that require an enterprise license key, [search "enterprise" on the environment variables reference](/self-host/customize-deployment/environment-variables).
</Tip>

## Troubleshooting

If enterprise features are unavailable after applying the key:

1. Confirm `LIGHTDASH_LICENSE_KEY` is set on **every** Lightdash container (backend, scheduler, workers).
2. Confirm every container was restarted after adding the key.
3. Confirm the per-feature environment flag is set (for example, `AI_COPILOT_ENABLED=true` for AI Analyst).
4. Confirm the server can reach `https://api.keygen.sh`.
5. Check the Lightdash logs for license-related errors.
6. Contact [enterprise support](https://calendly.com/lightdash-cloud/enterprise) if the issue persists.

## Related documentation

* [Enterprise on-prem setup](/self-host/enterprise-on-prem)
* [Production deployment checklist](/self-host/production-deployment-checklist)
* [Environment variables reference](/self-host/customize-deployment/environment-variables)
* [Configure SSO for self-hosted Lightdash](/self-host/customize-deployment/use-sso-login-for-self-hosted-lightdash)
* [Lightdash Cloud vs. self-hosted](/self-host/lightdash-cloud-vs-self-hosted)