Every licensed BIG-IP carries its entitlements in a plain text file, /config/bigip.license, and F5's K000160443 confirms both the location and that you can inspect it directly with grep or cat. The file's own header says the rest: DO NOT EDIT THIS FILE!!. Reading it is useful and safe; changing it by hand can leave the system inoperative. What follows is the file's anatomy, section by section, as observed in two real lab licenses, one managed by BIG-IQ License Manager and one licensed directly on the BIG-IP.
Two flavors of the same file
The header comment tells you immediately which world you are in. A directly licensed system carries BIG-IP System License Key File and an explicit install hint pointing at /config/bigip.license. A BIG-IQ managed license instead says BIG-IQ Product License File and carries two extra fields near the end: license_manager_key, a public key used by the license manager, and pool_license_information, an encoded copy of the pool license used for dossier validation. If those fields are present, BIG-IQ owns the licensing lifecycle of this instance.
Identity, then modules
The top of the file is identity: Auth vers (the license format generation), Usage (a class such as Production or an evaluation and lab designation), and Vendor. Then comes the module list, and its grammar matters. Each active module line is pipe-separated: the module's display name first, then that module's own key in a 7-7 shape, then the feature names. Commas are legal inside every segment, so BIG-IP, VE, LAB and SSL, 500 TPS Per Core are single names, and only the pipe separates fields. A file can carry several active module lines, each with a different key, which is exactly what tmsh show sys license renders as a module name followed by a key in parentheses. optional module lines list features that exist in the license as licensable but stay dormant until you buy and activate them; the system may even let you configure objects for one while the feature itself does nothing.
Keys and dates
The Registration Key is the base key for the whole system, a 27-character string in a 5-5-5-5-7 shape, per F5 K7752 and the worked example in K3782. The per-module keys on the active module lines are the add-on side of the same model. Two dates follow in compact yyyymmdd form. Licensed date records when the license was produced. Service check date is the one with operational teeth: per F5 K7727 it is the earlier of the last activation date and the service contract end, it is refreshed on every reactivation while a contract is active, and every BIG-IP version refuses to load its configuration after an upgrade if this date is older than the version's built-in License Check Date. Some licenses also carry License start and License end lines; both lab files omitted them, so treat them as optional and their absence as normal.
Constraints, tokens, and the parts you never share
VE licenses can pin what they are allowed to run. Repeatable Exclusive_version lines define the permitted software range, which is the mechanism F5 K42091606 tells you to check before choosing an upgrade target, and Deny_version lines exclude ranges explicitly. One detail trips readers up: F5's own worked example of this list in K42091606 includes low entries such as 5.*.* through 8.*.* alongside the BIG-IP ranges, and F5 reads the upgrade ceiling only from the BIG-IP-style entries; the article never says what the low entries denote. They sit below the 9.2.0 floor of the K7727 table, and BIG-IQ's own version space occupies exactly that 4.x to 8.x range per K15073 and K15113, so reading them as the license-manager side is the natural inference, though F5 does not label them. The ceiling itself maps to a Version Plus SKU generation per K15643; a list topping out at 16.*.* is the V16 range, 11.6.0 through 16.x. A related line documented in K42091606 is Service Status, which appears under Licensing Information when there is no active service contract. Exclusive_Platform lines pin platform IDs, and the Z100 family that fills them on VE licenses is Virtual Edition, per F5 K02011230. After that, the bulk of the file is feature and limit tokens: mod_ltm : enabled, perf_VE_throughput_Mbps : 10, asm_apps : unlimited. The spelling varies more than you would expect, with both enabled and enable, and both UNLIMITED and unlimited, so read them as equivalent. Finally, Dossier and Authorization carry the cryptographic proof that binds the license to the platform. Treat the whole file as sensitive because of the keys and signatures it contains, and never paste it anywhere public.
The F5 BIG-IP license explainer reads all of this in your browser, including the K7727 upgrade verdict for the service check date, and it never displays key or signature values.