NGINX Plus is the subscription product of the NGINX family that F5 acquired in May 2019 with NGINX, Inc.[1] Open source NGINX is separately licensed; the commercial licensing question is how subscription NGINX Plus instances prove entitlement and report usage.[2] F5 documents the mechanism at docs.nginx.com and sells NGINX under the same programmes as its other software, including the Flex Consumption Program.[3]
The JWT licence
F5’s documentation states that “starting with NGINX Plus R33, subscription licenses use JSON Web Tokens (JWTs) and require usage reporting.”[4] Key properties:[2]
- NGINX Plus R33 and later require a valid JWT licence.
- The licence is tied to the subscription, not to individual instances.
- It checks the subscription and reports usage to F5’s licensing endpoint (product.connect.nginx.com) or, in disconnected environments, through NGINX Instance Manager.
- A customer with several subscriptions has several JWT licences, may assign each instance to the licence it prefers, and NGINX combines usage reporting across all licensed instances. Combining licences in NGINX Instance Manager needs version 2.20 or later.
The licence is downloaded from MyF5 (My Products and Plans, Subscriptions, the subscription’s page) and placed on every instance, at /etc/nginx/license.jwt on Linux or /usr/local/etc/nginx/license.jwt on FreeBSD, or at a path set with the license_token directive; F5 recommends a Config Sync Group in the NGINX One Console or an instance group in NGINX Instance Manager to distribute it.[2] The metric is catalogued as NGINX Plus instance.
Startup, traffic and reporting requirements
The documentation sets these enforcement rules.[2]
| Situation | Behaviour |
|---|---|
| Starting NGINX Plus | Needs a valid, unexpired licence; if the licence has expired, NGINX Plus can still start during the 90-day grace period |
| Initial usage report | If F5’s licensing endpoint does not receive it, NGINX Plus will not process traffic until it is received |
| Postponing the first report | Setting enforce_initial_report to off starts a 180-day grace period during which NGINX Plus keeps running while it keeps trying to report |
| Ongoing reports | At least every 180 days; if reporting stops, NGINX Plus keeps running but stops processing traffic once 180 days have passed without a report |
In internet-connected environments instances must reach product.connect.nginx.com over HTTPS (TCP 443); from R34 they can go through an outbound proxy set in the mgmt block.[2] In network-restricted environments the usage_report directive points instances to NGINX Instance Manager, which collects reports and forwards them to F5.[2] For disconnected deployments, the customer downloads the usage report from NGINX Instance Manager, submits it to F5 from a system with internet access, and, before NGINX Instance Manager 2.22, uploaded the acknowledgement back; from 2.22 NGINX Instance Manager reports raw data instead of aggregated usage, so files are larger, and reporting through its REST API is no longer possible.[5]
These reporting rules sit under the Platform Terms, which let F5 or an authorised third party require licence management or reporting tools to provide true, accurate and timely usage reports and allow F5 to disable software that does not comply with the documentation.[6]
Renewals
From NGINX Plus R35, for instances that report directly to the licensing endpoint, the JWT is updated automatically after the subscription renews: beginning 30 days before the licence expires, NGINX Plus tells the endpoint during usage reporting, the endpoint checks for a renewed subscription, and NGINX Plus applies the new licence without a reload, storing it as nginx-mgmt-license in the state_path directory.[2] Automatic updates need reporting to be configured and at least one successful report. In earlier releases or disconnected environments the new JWT must be downloaded from MyF5 and deployed manually, and the documentation warns that subscriptions renewed under FCP do not support automatic JWT renewal.[7] A deferred update mode lets an organisation save the renewed token and apply it at a chosen time.[2]
Where the licence also applies
NGINX Ingress Controller. NGINX Plus Ingress Controller needs a valid JWT to download its image from the F5 registry, and from version 4.0.0 the token is also required to run NGINX Plus. It is stored in a Kubernetes Secret of type nginx.com/license in the controller’s namespace; telemetry goes to F5’s licensing endpoint, or through NGINX Instance Manager offline, by default every hour and whenever NGINX reloads. A Connectivity Stack for Kubernetes JWT does not work for NGINX Plus reporting; a regular NGINX Plus instance JWT is required.[8]
NGINX Instance Manager. Version 2.21 and earlier require a JWT licence from MyF5 to unlock all features and report entitlement and usage; starting with 2.22 NGINX Instance Manager no longer requires a JWT licence and all features are available after installation.[9] It continues to act as the collector for usage reporting from NGINX Plus instances.[5]
NGINXaaS for Azure
NGINXaaS for Azure is billed through the Azure Marketplace: “billed monthly based on hourly consumption”, with the infrastructure managed by F5 and the deployment resource visible in the customer’s Azure subscription.[10]
- Standard V3 has a fixed price per deployment of $0.25 per hour covering baseline overhead, NCU usage at $0.008 per hour per unit and data processing at $0.005 per GB, with a 99.95% uptime SLA, active-active high availability and dynamic autoscaling; the SKU is standardv3_Monthly.[10]
- Standard V2 is the earlier production plan with metered NCU consumption (standardv2_Monthly).[10]
- Developer is for early-stage trials, development and testing, with no SLA, no redundancy and no scaling; it is billed per deployment at the Azure Marketplace rate (developer_Monthly).[10]
An NGINX Capacity Unit (NCU) “quantifies the capacity of an NGINX instance based on the underlying compute resources”; each NCU provides 3,000 concurrent connections (a figure not guaranteed when F5 WAF for NGINX is used) and, on Standard V3, 2.2 Mbps of bandwidth.[10] Each NCU provisioned, not consumed, is billed at the marketplace rate; the minimum usage interval is one hour, and the maximum provisioned NCU size within an hour is billed for that hour.[10] Standard Azure networking and bandwidth charges also apply.[10] F5 supports in-place migration from Basic to Developer and from Standard or Standard V2 to Standard V3, and warns that legacy plans “will stop receiving automatic updates that address critical security issues”.[11] The metric is NGINX Capacity Unit (NCU).
Open source NGINX
The NGINX open source licence at nginx.org states copyright by Igor Sysoev (2002 to 2021) and Nginx, Inc. (2011 to 2026) and permits redistribution and use in source and binary forms, with or without modification, subject to retention of the copyright notice and disclaimer conditions.[12] The Platform Terms separately note that portions of F5 products contain open source components under their own licences, and that a customer must comply with them.[6] The licensing status of open source NGINX was a point in litigation: in a 2024 not-for-publication memorandum the Ninth Circuit held that a plaintiff had not identified any term of the open source NGINX licence that was violated by developing NGINX Plus, while allowing a copyright claim about NGINX Plus code allegedly developed at the plaintiff’s predecessor to proceed.[13] See the case article.
Procurement and compliance notes
- NGINX Plus under FCP is covered by Schedule A, whose reporting depends on the product; for NGINX the JWT usage reporting described above is the mechanism.[3]
- F5 describes the usage telemetry as part of its licensing programme and says it helps F5 improve products.[8]
- Because the licence follows the subscription, inventory work must reconcile the number and location of reporting instances with the subscriptions that issued the JWTs. NGINX Instance Manager’s “View recent NGINX usage” function exposes raw usage records for billing verification and compliance audits, according to its documentation index.[14]
- The JWT is sensitive information; F5 recommends storing and deleting it carefully.[8]
Out of scope
This article does not cover NGINX One Console pricing, F5 WAF for NGINX or F5 DoS for NGINX licensing, NGINXaaS for Google Cloud or AWS billing, or the NGINX Plus price list, none of which was retrieved as a citable document for this article.