# Migration from the embedded reference server

1. Deploy the standalone platform with a persistent data volume, a new `LICENSE_MASTER_KEY`, and bootstrap credentials.
2. Sign in as administrator.
3. In **Schlüsselverwaltung**, open **Bestehende Schlüsselpaare sicher importieren** and provide the existing issuer and lease private keys plus their original key IDs. This action is write-once.
4. Download `GET /api/v1/trust-store` and update the public trust store embedded in each product build.
5. Register existing, still-valid license tokens through one of these routes:
   - `POST /api/v1/licenses/import` with `{"token":"...","customerUserId":"optional"}`;
   - legacy-compatible `POST /v1/admin/licenses` with `{"token":"..."}`;
   - the existing local `licenseweb`, pointed at the new platform URL and management bearer token.
6. Set `LICENSE_PUBLIC_URL` to the stable external HTTPS URL. Newly issued hybrid/online licenses will contain this URL as a signed claim.
7. Existing licenses without `verification.serverUrl` continue to work when clients receive `LICENSE_SERVER_URL` or well-known discovery.

Do not generate new keys when migrating existing licenses. A new issuer key would make old tokens unverifiable unless both old and new public keys are retained in the product trust store.