Skip to main content
SourceTrust
See other licenses

AGPL-3.0-or-later

GNU AGPL v3.0 or later

AGPL-3.0-or-later is AGPLv3 plus permission to take a later Affero GPL. Section 13 still attaches to a modified version users reach over a network.

On this page

What it does

GNU AGPL v3.0 or later is the Affero grant plus permission to use later AGPL versions from the FSF. Besides ordinary GPLv3 distribution rules, section 13 says that if you modify the program and let users interact with it remotely over a network, you must offer those users the Corresponding Source of your modified version, free of charge, from a network server. Nextcloud ships this form. Contrast AGPL-3.0-only, which pins version 3 and is the form Grafana, Mastodon and MinIO commonly declare.

Details

The or-later token does not change when section 13 fires. Two words still decide most cases: modified version. Running stock AGPL software unchanged is a different position from running a patched build. What or-later adds is that a recipient may take a future AGPL from the FSF. Until they do, you still owe the GPLv3 corresponding-source rules on a conveyed binary and the section 13 network offer on a modified hosted version.

Pros

  • Stops the SaaS loophole: you cannot take the code, run a modified version as a service, and never share those changes.
  • The or-later token lets recipients take a future AGPL, the same way GPL-3.0-or-later works for ordinary GPL.

Cons

  • A SaaS product that includes a modified covered work may have to offer corresponding source of that version, not only of a downloadable binary.
  • Procurement and investors treat this family as high scrutiny. Expect extra review before you publish a page that lists it.

What it allows and requires

Choose a category to see the full grant in one scannable list. Permissions show what the license allows, limits show what it withholds, and obligations show the conditions your release process must satisfy.

Permissions

  • Commercial use

    You may ship the code inside a paid product. The license does not restrict commercial use.

  • Modify

    You may change the code, including keeping those changes private, unless a later obligation says otherwise.

  • Distribute

    You may give copies to others. Distribution is what usually turns notice and source duties into real work.

  • Private use

    Use inside your company, including internal forks, does not by itself trigger distribution duties.

What AGPL-3.0-or-later requires when you ship

For AGPL-3.0-or-later, offering the software as a hosted service can trigger the same source duty that handing someone a binary would. Confirm what you run, not only what you ship as a file. Network copyleft is written for that gap. The steps below are the shipping and hosting work, in the order a reviewer usually walks them.

  1. You are outside section 13 while the program runs unmodified. The clause attaches to your modified version, whether or not recipients could later elect a newer AGPL.

  2. You meet section 13 when users of your modified version can get its Corresponding Source at no charge, offered prominently from a network server.

  3. You meet the GPLv3 half when a binary you convey ships with the complete corresponding source of the combined work under the AGPL, until a later AGPL is elected.

  4. You keep the or-later grant visible when headers, SPDX, and the shipped text all say or later, so a recipient can actually elect a future AGPL.

  5. You have scoped the clause when you can say what counts as the program and what is your surrounding application, and counsel agrees with the line you drew.

The duties named in AGPL-3.0-or-later

Notice still travels with any copy. AGPL-3.0-or-later also names a source duty that can fire when you offer the software as a hosted service. These are the conditions in the text.

Include copyright

Keep copyright notices on distributed copies.

Include license

Give recipients a copy of the license with the program.

Disclose source

When you distribute a binary of a covered work, corresponding source has to be offered in the way the license describes.

Same license

The combined work you distribute has to stay under this license. You cannot close the covered work with a more restrictive grant.

Disclose source

AGPL adds a network trigger. If users interact with a modified covered work over a network, they must be able to get the corresponding source.

Later AGPL

Or later lets a recipient take a future AGPL from the FSF. Until they do, section 13 still attaches to your modified version on the network.

Things to be aware of

  • Filing this id as AGPL-3.0-only because Grafana uses only. Nextcloud and other or-later projects granted an upgrade the only id would strip.
  • Reading or-later as if it delayed section 13 until a future AGPL exists. Section 13 already applies to your modified version today.
  • Patching an AGPL component in a private fork and treating it as an internal detail. That patch is exactly what section 13 asks you to offer to users of your service.

What the GNU AGPL v3.0 or later does not do

Search results often flatten GNU AGPL v3.0 or later into a slogan. These are the usual misreads. AGPL-3.0-or-later is a grant with conditions, not a permission to skip the paperwork below.

  • AGPL-3.0-or-later is not GPL-3.0-or-later with a different number. Remote network interaction with a modified version is still a distribution-like trigger.
  • It does not let a SaaS product skip the source offer because no binary shipped. Section 13 is independent of conveying a copy.

How AGPL-3.0-or-later differs from nearby licenses

These licenses are often confused with AGPL-3.0-or-later, but their release duties differ. Each row summarizes what the license requires when you ship. Open the linked page for the full checklist.

AGPL-3.0-or-later
AGPL-3.0-or-later is AGPLv3 plus permission to take a later Affero GPL. Section 13 still attaches to a modified version users reach over a network.
AGPL-3.0-only
AGPL is GPLv3 plus section 13: if you let users reach your modified version over a network, they can ask you for its source.
GPL-3.0-or-later
GPL-3.0-or-later is GPLv3 plus permission to take a later FSF GPL. That election is how Apache-2.0 code becomes combinable in a GPL tree.
SSPL-1.0
SSPL is MongoDB's rewrite of the AGPL. Offer the software as a service and its section 13 asks for the source of your whole service stack.

Common questions about GNU AGPL v3.0 or later

Answers to common questions about what GNU AGPL v3.0 or later requires, when its duties apply, and what evidence belongs with a release.

What is the GNU AGPL v3.0 or later?

GNU AGPL v3.0 or later is the Affero grant plus permission to use later AGPL versions from the FSF. Besides ordinary GPLv3 distribution rules, section 13 says that if you modify the program and let users interact with it remotely over a network, you must offer those users the Corresponding Source of your modified version, free of charge, from a network server. Nextcloud ships this form. Contrast AGPL-3.0-only, which pins version 3 and is the form Grafana, Mastodon and MinIO commonly declare.

What does AGPL-3.0-or-later require when you ship a product?

You are outside section 13 while the program runs unmodified. The clause attaches to your modified version, whether or not recipients could later elect a newer AGPL. You meet section 13 when users of your modified version can get its Corresponding Source at no charge, offered prominently from a network server. You meet the GPLv3 half when a binary you convey ships with the complete corresponding source of the combined work under the AGPL, until a later AGPL is elected. You keep the or-later grant visible when headers, SPDX, and the shipped text all say or later, so a recipient can actually elect a future AGPL. You have scoped the clause when you can say what counts as the program and what is your surrounding application, and counsel agrees with the line you drew.

Does running AGPL-3.0-or-later as a hosted service trigger the source duty?

Yes. For AGPL-3.0-or-later, offering the software as a hosted service can trigger the same source duty that distribution would. That is the point of this family.

What is corresponding source for AGPL-3.0-or-later?

Corresponding source is the source a recipient needs to build and run the same binary, including scripts and interface files the license names. Hosting a repository URL can be an offer. The offer has to match what you actually shipped. SourceTrust records that a person on your team confirmed the offer. It does not publish your source and does not host a mirror.

How is AGPL-3.0-or-later different from GNU AGPL v3.0?

AGPL-3.0-or-later asks this: AGPL-3.0-or-later is AGPLv3 plus permission to take a later Affero GPL. Section 13 still attaches to a modified version users reach over a network. GNU AGPL v3.0 asks this: AGPL is GPLv3 plus section 13: if you let users reach your modified version over a network, they can ask you for its source. Open the GNU AGPL v3.0 page for what that license requires when you ship. Do not treat the SPDX ids as interchangeable because the short names look similar.

Where do I record AGPL-3.0-or-later for a buyer?

The catalog marks AGPL-3.0-or-later as a license that network use does not clear, so a network review item appears on the project checklist for SaaS and Mixed projects. A separate source offer item appears only when the project also ships binaries. Both wait for a person. SourceTrust does not publish source. A package that declares or-later but ships an only text lands as a mismatch.

Where do I record AGPL-3.0-or-later for a buyer?

The catalog marks AGPL-3.0-or-later as a license that network use does not clear, so a network review item appears on the project checklist for SaaS and Mixed projects. A separate source offer item appears only when the project also ships binaries.

Both wait for a person. SourceTrust does not publish source.

A package that declares or-later but ships an only text lands as a mismatch. Read /docs/inventory-compliance to find every AGPL component across your projects.

See also

The hub is the pillar for this cluster. Sibling licenses are the other spokes. Product FAQ links explain how SourceTrust records the duty, not the license text itself.

Practical guidance for procurement review, not legal advice. Confirm high-stakes use with counsel.

Ship the proof.

Import GNU AGPL v3.0 or later and the rest of what you ship. Free to import and review. You only pay when you publish.

Start for free

Cookies on sourcetrust.dev

We use essential cookies for security, including abuse prevention on our site scan and walkthrough request form. With your permission, we also use optional analytics and diagnostics (Google Tag Manager on this site, and the Sentry browser SDK on the SourceTrust application when configured). See our cookie policy.