# Enterprise Core

Self-host the Enterprise version beside open-source Core, then connect them with an Enterprise license.

This feature is only available in the Enterprise version

Enterprise Core adds enterprise modules on top of the open-source Core: role-based access, a SQL-based data lake, alerts, audit logs, MCP, agents, and a dashboard with an extensible UI.

Deploy open-source Core first with the [open-source guide](/deploy/open-source). 

This page deploys the enterprise modules beside it and connects them to that Core. The full environment reference is in [License configuration](/operating/configuration/enterprise/launcher).

## Deploy Enterprise

<Steps>
<Step title="Get your license">

Get your Enterprise license by [contacting us](https://blnkfinance.com/contact/us?utm_source=blnk_docs&utm_medium=documentation&utm_campaign=deploy%2Fenterprise). 

Once your order is confirmed, you'll receive an email with a base64 license key. Set it as `ENTERPRISE_LICENSE_B64`.

</Step>

<Step title="Create the database">

In your managed Postgres, create a new database named `blnk-cloud`. Save the connection URL for `ENTERPRISE_POSTGRES_URL`.

```sql Create the database
CREATE DATABASE "blnk-cloud";
```

<Tip>We recommend using the same Postgres database for both open-source Core and Enterprise modules.</Tip>

</Step>

<Step title="Write the environment file">

```bash .env wrap
HOSTNAME=127.0.0.1
ENTERPRISE_POSTGRES_URL=postgres://user:password@host:5432/blnk-cloud?sslmode=require
ENTERPRISE_LICENSE_B64=your_base64_license_string
ENTERPRISE_SKIP_CORE=true
ENTERPRISE_AUTO_PROVISION=false
ENTERPRISE_PUBLIC_PORT=8080
ENTERPRISE_PUBLIC_URL=https://ledger.yourdomain.com
CORS_ORIGINS=http://localhost:8080,http://localhost:3001,https://ledger.yourdomain.com
BLNK_ENCRYPTION_KEY=your_secure_32_character_key
JWT_SECRET=your_long_random_secret
```

<Warning>Generate a secure encryption key and JWT secret before these modules start. Use a random 32-character key and a long random secret.</Warning>

| Variable | What to set |
| :--- | :--- |
| `HOSTNAME` | `127.0.0.1`, so health checks stay on the container loopback. |
| `ENTERPRISE_POSTGRES_URL` | Connection string for the Postgres instance that holds `blnk-cloud`. |
| `ENTERPRISE_LICENSE_B64` | The base64 license key from sales. |
| `ENTERPRISE_AUTO_PROVISION` | `false`, so Enterprise does not create a managed instance or bootstrap the query agent. |
| `ENTERPRISE_PUBLIC_PORT` | Port this deployment listens on. The sample uses `8080`. |
| `ENTERPRISE_PUBLIC_URL` | Public URL of this deployment, including `https://`. |
| `CORS_ORIGINS` | Browser origins allowed to call this deployment, with no spaces. Include `ENTERPRISE_PUBLIC_URL`. |
| `BLNK_ENCRYPTION_KEY` | A secure random 32-character key. It encrypts values such as instance connection keys. |
| `JWT_SECRET` | A long, secure random secret for authentication tokens. |

</Step>

<Step title="Start the enterprise modules">

Map the host port to `ENTERPRISE_PUBLIC_PORT`. With the file above, that is `8080`. If sales sent a different image name, use that tag instead.

```bash Start Enterprise
docker run -d \
  --name blnk-enterprise \
  --env-file .env \
  -p 8080:8080 \
  ghcr.io/blnkfinance/blnk-enterprise:latest
```

The container name is `blnk-enterprise`, and the modules are available at `ENTERPRISE_PUBLIC_URL`.

</Step>

<Step title="Connect your Core">

Open `ENTERPRISE_PUBLIC_URL`, sign up, and create the workspace. Then open **Connect an instance** and submit the Core you deployed.

- **Instance name:** a name for this Core
- **Core URL:** the URL of that Core
- **Core secret key:** the `secret_key` from the Core configuration

Click **Create connection**.

![Connect an instance form with Core URL and secret key](img/deploy/instance-creation-form.png)

Copy the **Connection key** from the instance details.

![Instance details with the connection key](img/deploy/connection-key.png)

</Step>

<Step title="Run the query agent">

`CONNECTION_URL` is `ENTERPRISE_PUBLIC_URL` as a WebSocket URL with `/ws/agent` on the path. `https://` becomes `wss://`, and `http://` becomes `ws://`.

| `ENTERPRISE_PUBLIC_URL` | `CONNECTION_URL` |
| :--- | :--- |
| `https://ledger.yourdomain.com` | `wss://ledger.yourdomain.com/ws/agent` |
| `http://localhost:8080` | `ws://localhost:8080/ws/agent` |

```bash Run the query agent
docker run -d \
  -e DB_URL="postgres://username:password@host:5432/blnk?sslmode=require" \
  -e CONNECTION_KEY="sk_live_..." \
  -e CONNECTION_URL="wss://ledger.yourdomain.com/ws/agent" \
  blnkfinance/query-agent:latest
```

| Variable | What to set |
| :--- | :--- |
| `DB_URL` | `data_source.dns` from the Core configuration. |
| `CONNECTION_KEY` | The connection key you copied from the instance details. |

When the agent is running, the query agent setup would update to **Connected**.

![Query agent status showing Connected](img/deploy/instance-connected.png)

</Step>
</Steps>

## FAQs

<AccordionGroup>
  <Accordion title="The enterprise container exits">

`docker logs blnk-enterprise` prints the reason. 

A license failure is logged as `Server exited: verify enterprise license`. Confirm `ENTERPRISE_LICENSE_B64` is the base64 key from the email, with no spaces or line breaks.

  </Accordion>
  <Accordion title="The query agent does not show Connected">

The agent logs `Failed to create agent` when `DB_URL` or `CONNECTION_KEY` is missing. 

If `CONNECTION_URL` is empty, the agent connects to `wss://api.cloud.blnkfinance.com/ws/agent` instead of your deployment.

  </Accordion>
  <Accordion title="The agent is connected but ledger data is missing">

`DB_URL` has to be the Core database, the same value as `data_source.dns`. 

The `blnk-cloud` database on `ENTERPRISE_POSTGRES_URL` holds the enterprise modules, not the ledger.

  </Accordion>
  <Accordion title="Enterprise created an instance you did not add">

Open the actions list on the instance Enterprise created and click **Delete instance**.

  </Accordion>
</AccordionGroup>

<RelatedTopics
  items={[
    { title: "Open-source", href: "/deploy/open-source" },
    { title: "License configuration", href: "/operating/configuration/enterprise/launcher" },
  ]}
/>