Skip to main content
SourceTrust
See other licenses

AGPL-3.0-only

GNU AGPL v3.0

AGPL is GPLv3 plus section 13: if you let users reach your modified version over a network, they can ask you for its source.

On this page

What it does

The AGPL is GPL version 3 with one extra clause. Section 13 says that if you modify the program and let users interact with it remotely over a network, you must offer those users the Corresponding Source of your modified version. That offer is free of charge and made from a network server. Everything else in GPLv3 still applies when you convey a binary. The clause exists to close what its authors called the application service provider loophole: hosting is not distribution, so classic copyleft never reached a hosted service. Grafana, Mastodon, Nextcloud and MinIO use it.

Details

Two words in section 13 decide most AGPL cases: modified version. Running stock AGPL software as part of your service, unchanged, is a materially different position from running a patched build. Change one line and section 13 has something to attach to. The harder question is where your application ends and the program begins, and no SPDX id can answer that. Take this component to counsel before the architecture hardens around it, not after a customer asks.

Pros

  • Stops the SaaS loophole: you cannot take the code, run it as a service, and never share your changes.
  • Makes the network trigger explicit, so a hosted product has a yes-or-no question instead of a distribution debate.

Cons

  • A SaaS product that includes this code may have to offer corresponding source of the service, not only of a downloadable binary.
  • Procurement and investors treat this family as high scrutiny. Expect extra review before you publish a page that lists it.

What it allows and requires

Choose a category to see the full grant in one scannable list. Permissions show what the license allows, limits show what it withholds, and obligations show the conditions your release process must satisfy.

Permissions

  • Commercial use

    You may ship the code inside a paid product. The license does not restrict commercial use.

  • Modify

    You may change the code, including keeping those changes private, unless a later obligation says otherwise.

  • Distribute

    You may give copies to others. Distribution is what usually turns notice and source duties into real work.

  • Private use

    Use inside your company, including internal forks, does not by itself trigger distribution duties.

What AGPL-3.0-only requires when you ship

For AGPL-3.0-only, offering the software as a hosted service can trigger the same source duty that handing someone a binary would. Confirm what you run, not only what you ship as a file. Network copyleft is written for that gap. The steps below are the shipping and hosting work, in the order a reviewer usually walks them.

  1. You are outside section 13 while the program runs unmodified. The clause attaches to your modified version, so an untouched build in your stack is the easier position to hold and still worth documenting.

  2. You meet section 13 when users of your modified version can get its Corresponding Source at no charge, offered prominently from a network server rather than on request by email.

  3. You meet the GPLv3 half when a binary you convey ships with the complete corresponding source of the combined work, under the AGPL.

  4. You have scoped the clause when you can say what counts as the program and what is your surrounding application, and counsel agrees with the line you drew.

  5. You have the arm's-length case when your product only talks to an AGPL database or queue over a socket. Separate processes at arm's length are the usual carve-out, and it still needs a look.

The duties named in AGPL-3.0-only

Notice still travels with any copy. AGPL-3.0-only also names a source duty that can fire when you offer the software as a hosted service. These are the conditions in the text.

Include copyright

Keep copyright notices on distributed copies.

Include license

Give recipients a copy of the license with the program.

Disclose source

When you distribute a binary of a covered work, corresponding source has to be offered in the way the license describes.

Same license

The combined work you distribute has to stay under this license. You cannot close the covered work with a more restrictive grant.

Disclose source

AGPL adds a network trigger. If users interact with a modified covered work over a network, they must be able to get the corresponding source.

Things to be aware of

  • Reading section 13 as 'hosting AGPL software means publishing your source'. It attaches to your modified version, so the first question is whether you changed the program at all.
  • Expecting two checklist items on every AGPL component. Under the default SaaS distribution context only the network review appears; the source offer needs Distributed binary or Mixed.
  • Assuming an AGPL database your app merely queries pulls the app itself into the AGPL. It usually does not, but the answer depends on how tightly the two are joined.
  • Patching an AGPL component in a private fork and treating it as an internal detail. That patch is exactly what section 13 asks you to offer to the users of your service.

What the GNU AGPL v3.0 does not do

Search results often flatten GNU AGPL v3.0 into a slogan. These are the usual misreads. AGPL-3.0-only is a grant with conditions, not a permission to skip the paperwork below.

  • AGPL is not GPL with a different number. Remote network interaction is a distribution-like trigger.
  • It does not let a SaaS product include AGPL code and skip the source offer because no binary shipped.

How AGPL-3.0-only differs from nearby licenses

These licenses are often confused with AGPL-3.0-only, but their release duties differ. Each row summarizes what the license requires when you ship. Open the linked page for the full checklist.

AGPL-3.0-only
AGPL is GPLv3 plus section 13: if you let users reach your modified version over a network, they can ask you for its source.
AGPL-3.0-or-later
AGPL-3.0-or-later is AGPLv3 plus permission to take a later Affero GPL. Section 13 still attaches to a modified version users reach over a network.
GPL-3.0-only
GPL-3.0 keeps the source duty on distributed binaries and adds a patent grant, an anti-lockdown rule for consumer devices, and a cure period.
SSPL-1.0
SSPL is MongoDB's rewrite of the AGPL. Offer the software as a service and its section 13 asks for the source of your whole service stack.

Common questions about GNU AGPL v3.0

Answers to common questions about what GNU AGPL v3.0 requires, when its duties apply, and what evidence belongs with a release.

What is the GNU AGPL v3.0?

The AGPL is GPL version 3 with one extra clause. Section 13 says that if you modify the program and let users interact with it remotely over a network, you must offer those users the Corresponding Source of your modified version. That offer is free of charge and made from a network server. Everything else in GPLv3 still applies when you convey a binary. The clause exists to close what its authors called the application service provider loophole: hosting is not distribution, so classic copyleft never reached a hosted service. Grafana, Mastodon, Nextcloud and MinIO use it.

What does AGPL-3.0-only require when you ship a product?

You are outside section 13 while the program runs unmodified. The clause attaches to your modified version, so an untouched build in your stack is the easier position to hold and still worth documenting. You meet section 13 when users of your modified version can get its Corresponding Source at no charge, offered prominently from a network server rather than on request by email. You meet the GPLv3 half when a binary you convey ships with the complete corresponding source of the combined work, under the AGPL. You have scoped the clause when you can say what counts as the program and what is your surrounding application, and counsel agrees with the line you drew. You have the arm's-length case when your product only talks to an AGPL database or queue over a socket. Separate processes at arm's length are the usual carve-out, and it still needs a look.

Does running AGPL-3.0-only as a hosted service trigger the source duty?

Yes. For AGPL-3.0-only, offering the software as a hosted service can trigger the same source duty that distribution would. That is the point of this family.

What is corresponding source for AGPL-3.0-only?

Corresponding source is the source a recipient needs to build and run the same binary, including scripts and interface files the license names. Hosting a repository URL can be an offer. The offer has to match what you actually shipped. SourceTrust records that a person on your team confirmed the offer. It does not publish your source and does not host a mirror.

How is AGPL-3.0-only different from GNU AGPL v3.0 or later?

AGPL-3.0-only asks this: AGPL is GPLv3 plus section 13: if you let users reach your modified version over a network, they can ask you for its source. GNU AGPL v3.0 or later asks this: AGPL-3.0-or-later is AGPLv3 plus permission to take a later Affero GPL. Section 13 still attaches to a modified version users reach over a network. Open the GNU AGPL v3.0 or later page for what that license requires when you ship. Do not treat the SPDX ids as interchangeable because the short names look similar.

Where do I record AGPL-3.0-only for a buyer?

The catalog marks AGPL-3.0-only as a license that network use does not clear, so a network review item appears on the project checklist for SaaS and Mixed projects. A separate source offer item appears only when the project also ships binaries, which means the Distributed binary or Mixed context. Both wait for a person to confirm them, and publishing is blocked until every applicable item is confirmed. SourceTrust does not publish source for you. The component page also shows a critical compatibility warning when an AGPL component sits in a project whose context is SaaS or Mixed.

Where do I record AGPL-3.0-only for a buyer?

The catalog marks AGPL-3.0-only as a license that network use does not clear, so a network review item appears on the project checklist for SaaS and Mixed projects. A separate source offer item appears only when the project also ships binaries, which means the Distributed binary or Mixed context.

Both wait for a person to confirm them, and publishing is blocked until every applicable item is confirmed. SourceTrust does not publish source for you.

The component page also shows a critical compatibility warning when an AGPL component sits in a project whose context is SaaS or Mixed. Read /docs/inventory-compliance to find every AGPL component across your projects.

  • Two items on the same component happen only in the Mixed context. In the default SaaS context you see the network review and nothing else.
  • Confirming the network review records that you and your counsel looked at it. It is your own attestation, not a check of your architecture.

See also

The hub is the pillar for this cluster. Sibling licenses are the other spokes. Product FAQ links explain how SourceTrust records the duty, not the license text itself.

Practical guidance for procurement review, not legal advice. Confirm high-stakes use with counsel.

Ship the proof.

Import GNU AGPL v3.0 and the rest of what you ship. Free to import and review. You only pay when you publish.

Start for free

Cookies on sourcetrust.dev

We use essential cookies for security, including abuse prevention on our site scan and walkthrough request form. With your permission, we also use optional analytics and diagnostics (Google Tag Manager on this site, and the Sentry browser SDK on the SourceTrust application when configured). See our cookie policy.