Skip to main content

Glossary

Terms used when you operate a Kuploy product: licensing, identity, and the platform layers. The vocabulary your customers meet — application, project, deployment, build minutes, plan — is defined in the developer glossary, which is written for them and is the single home for those terms.

A​

Aggregate Quotas Usage limits that are summed across all kuploy-cloud instances linked to the same license. For example, if two instances have 10 projects each under a 20-project plan, the aggregate usage is 20/20 (100%).

C​

Claim Code A short-lived code (format: XXXX-XXXX, e.g., KPXY-4829) used to link a kuploy-cloud instance to a license. Generated by the instance, entered at kuploy.app/claim. Expires after 15 minutes.

E​

epay-gateway Self-hosted payment gateway that routes one-time payments and subscriptions to West-African mobile-money and card providers (Orange Money, MTN MoMo, KULU, Visa/MasterCard via Djomy, PayCard, CinetPay). Every payment an organisation makes on kuploy-cloud — card and mobile money alike — runs through it, on Business+ plans. See ePay; its own reference is at docs.epay.kuploy.app.

F​

Feature Flags Capabilities that are enabled or disabled based on the tenant's platform plan. Includes: custom domains, AI assistant, multi-server, priority support, white-label, and domain purchase.

I​

Instance A single kuploy-cloud deployment, running on a Kubernetes cluster and linked to a license. A tenant can run multiple instances depending on their platform plan.

is_tenant_owner_of (OIDC claim) List of tenant IDs the signed-in user owns, emitted on kuploy.app's userinfo / id_token responses. Downstream products gate their operator surfaces on it: "does this user own the tenant this deployment is licensed to?" This is what makes an independent operator the admin of their own deployment. See OIDC Custom Claims.

K​

kuploy The open-source deployment engine. Provides Git-based deployments, managed databases, SSL, and container orchestration on Kubernetes.

kuploy-cloud The commercial edition of Kuploy. Extends the open-source core with multi-tenant billing, licensing, admin dashboard, team management, and quota enforcement.

kuploy-hub The licensing + identity hub running at kuploy.app. Issues licenses, runs the claim-code flow, aggregates usage across instances, and acts as the OpenID Connect identity provider for first-party products. Used interchangeably with kuploy.app in operator docs.

kuploy.app The centralized licensing and billing hub. Tenants subscribe to platform plans here. Issues license keys, manages aggregate quotas, and provides the claim code flow.

kuploy_hub_admin (OIDC claim) Boolean claim emitted on kuploy.app's userinfo / id_token responses. True when the signed-in user is Kuploy platform staff. It grants authority on kuploy.app itself and is deliberately not the gate for operator surfaces on a downstream deployment — see is_tenant_owner_of. See OIDC Custom Claims.

KUPLOY_OIDC_TRUSTED_CLIENTS JSON-array environment variable on kuploy-hub that registers first-party SSO consumers. Each entry's redirectUrls is validated for both OAuth callbacks and post-logout redirects. See SSO with kuploy-hub.

L​

License A key (lic_xxx) issued at kuploy.app that authorizes a kuploy-cloud instance to operate. Carries plan limits, feature flags, and quota information. Syncs periodically with the licensing hub.

License Sync Periodic communication between a kuploy-cloud instance and kuploy.app. Reports local usage, receives updated limits, aggregate usage, and warnings. Default interval: 5 minutes.

O​

OIDC (OpenID Connect) The authentication layer kuploy-hub uses to act as the identity provider for first-party products. Consumers federate via Better Auth's genericOAuth plugin pointed at the hub's discovery URL. See SSO with kuploy-hub and OIDC Custom Claims.

P​

Platform Plan A subscription at kuploy.app — Layer 1, what an operator pays Kuploy for a product. Controls what that product's deployments can do: aggregate limits, feature flags, and the ceiling on the operator's own plans. See Plans & the two layers.

R​

requireInstanceAdmin Server-side gate used by first-party products (leeram-business today) to authorise license-management actions on a self-hosted deployment. Resolves the tenant the deployment is licensed to from the license payload, then calls kuploy.app's /oauth2/userinfo live on each invocation and checks that is_tenant_owner_of contains it. Failures use notFound() rather than redirect — the URL appears non-existent to anyone unauthorised. See Licensing & Platform Plans.

RP-Initiated Logout OIDC standard flow where a relying party (consumer) terminates the IdP's session in addition to its own local session. kuploy-hub publishes end_session_endpoint (at /api/auth/oauth2/endsession) for this. Without it, signing out of a consumer leaves the kuploy.app session cookie alive and a subsequent SSO sign-in silently re-auths. See SSO with kuploy-hub.

T​

Tenant An ISP, ITSP, or hosting provider who runs one or more kuploy-cloud instances. Subscribes to a platform plan at kuploy.app, and defines the instance plans their own customers buy inside each instance, at /admin/plans.