License guide · Permissive

Apache License 2.0, in plain English

The Apache License 2.0 is permissive and safe for commercial, proprietary software — like MIT, it lets you ship closed-source products built on it without publishing your own code. What sets it apart is that it was drafted by lawyers for corporate use: it adds an express patent grant, a defensive termination clause, and a NOTICE-file obligation that MIT has no equivalent of.

Updated 14 Aug 2026 · by the depproof team

General information, not legal advice. The controlling text is the license itself as shipped with the dependency. Primary source: the Apache License, Version 2.0.

What is the Apache License 2.0?

The Apache License 2.0 is a permissive, OSI-approved open-source license published by the Apache Software Foundation in January 2004. It grants anyone a perpetual, worldwide, royalty-free right to use, copy, modify, distribute and sublicense the software — including inside closed-source commercial products — in exchange for a set of attribution obligations. It has no copyleft: using an Apache-2.0 component never obliges you to publish your own source.

You will see it written several ways, all meaning the same license: its formal name is Apache License, Version 2.0; its SPDX identifier is Apache-2.0, which is the form that appears in dependency metadata and SBOMs; and it is commonly shortened to Apache 2.0, Apache 2, or (in British spelling) Apache Licence 2.0. There is no meaningful difference between them.

In one sentence: it is the permissive license that takes patents seriously. Everything below follows from that and from the attribution price it charges in return.

Type: permissive (not copyleft) · SPDX: Apache-2.0 · Published: 2004 by the Apache Software Foundation.
Commercial use: permitted, including proprietary and closed-source products you sell.
You must: include the license, keep existing notices, mark files you changed, and propagate any NOTICE file.
You get: an express patent grant from every contributor — the thing MIT and BSD do not give you.

Is the Apache License 2.0 safe for commercial use?

Yes — unreservedly. You can build a proprietary product on Apache-2.0 dependencies, sell it, keep your own source closed, and run it as a hosted service with no disclosure obligation of any kind. There is no network clause of the sort AGPL-3.0 carries, and no reciprocal obligation of the sort the GPL family carries.

The obligations that do exist attach to the Apache-2.0 component you redistribute, not to your product: carry its license, keep its notices, say which of its files you modified, and pass on its NOTICE content. That is an attribution problem, not a permission problem — which is why Apache-2.0 is almost never the license that blocks a release, and often the one that quietly generates the most paperwork.

The patent grant — the reason Apache-2.0 exists

MIT and BSD are copyright licenses that say nothing about patents. Apache-2.0 addresses them head-on. Section 3 grants an express, perpetual, worldwide, royalty-free and irrevocable patent license from each contributor, covering the patent claims they control that their contribution necessarily infringes.

It is paired with defensive termination: if you initiate patent litigation claiming the work infringes a patent, your patent license under Apache-2.0 ends. The effect is a mutual non-aggression arrangement among everyone using the code — which is precisely why large organisations with patent portfolios tend to standardise on it.

Deciding between the two for a project of your own? MIT vs Apache-2.0 sets them side by side — patents, attribution burden, and GPL compatibility. The license compatibility matrix puts the GPL-2.0 conflict in context against every other pairing you are likely to hit.

The NOTICE file: the obligation teams actually miss

Apache-2.0’s redistribution conditions go a step beyond “keep the license text.” When you distribute the work or a derivative of it, you must:

Include the license. A copy of Apache-2.0 travels with any copy or derivative you distribute.
Retain the notices. Copyright, patent, trademark and attribution notices in the source must be preserved.
State significant changes. Modified files must carry prominent notices saying you changed them.
Propagate the NOTICE file. If the work includes a NOTICE file, its attribution content must appear in your derivative’s own notices — in the distribution, the documentation, or the display generated by the work.

That last one is the distinctive obligation, and it is the one most often overlooked. Shipping the Apache-2.0 license text alone does not satisfy it: the upstream NOTICE content has to be carried forward. Across a tree with hundreds of Apache-2.0 components this is only tractable as a generated artifact.

Can you…? The Apache-2.0 decision at a glance

Can you…	Under Apache-2.0?
Use it in closed-source, proprietary commercial software	Yes
Sell a product that includes it	Yes
Modify it and keep your modifications private	Yes — but modified files must be marked as changed
Rely on an express patent grant	Yes — unlike MIT and BSD
Run it as a SaaS without disclosing anything	Yes — no network clause
Drop the upstream NOTICE file content	No — it must be propagated
Use the project’s name or trademarks to promote your product	No — trademark rights are expressly not granted
Combine it into a GPL-2.0 project	No — FSF treats it as incompatible with GPL-2.0
Combine it into a GPL-3.0 project	Yes — the combined work goes out under GPL-3.0

The GPL-2.0 incompatibility trap

Apache-2.0 is compatible with GPL-3.0 but not with GPL-2.0. The Free Software Foundation’s position is that Apache-2.0’s patent-termination and indemnification terms count as additional restrictions, which GPL-2.0 does not permit. GPL-3.0 was written with explicit accommodation for exactly this.

This matters in practice because the incompatibility is version-specific and one-directional, so it hides easily. A tree containing both an Apache-2.0 component and a GPL-2.0-only component has a genuine conflict that no amount of notice-file diligence fixes — and it will not announce itself unless something is classifying licenses at the component level.

Apache-2.0 vs GPL-3.0 sets the permissive and copyleft models side by side in full — what each obliges you to publish, the two triggers people get wrong, and why the compatibility only runs one way.

Finding your Apache-2.0 obligations

Apache-2.0 is almost never a blocker — it is an attribution problem rather than a permission problem. The work is knowing which components carry it, which of those ship a NOTICE file, and producing the combined notices artifact your distribution needs.

Check your Maven dependency licenses — Apache-2.0 dominates the JVM ecosystem, so this is where the NOTICE burden concentrates.
Check your npm dependency licenses — classify every direct and transitive package from the lockfile.
See org-wide license posture — roll every project’s license mix into one view for legal and compliance.

Frequently asked questions

What is the Apache License 2.0?

The Apache License 2.0 is a permissive, OSI-approved open-source license published by the Apache Software Foundation in 2004. It grants a perpetual, worldwide, royalty-free right to use, copy, modify, distribute and sublicense the software — including inside closed-source commercial products — in exchange for attribution obligations: include the license, keep existing notices, mark files you changed, and propagate any NOTICE file. It has no copyleft, so it never obliges you to publish your own source. Its SPDX identifier is Apache-2.0, and it is also written Apache License Version 2.0, Apache 2.0 or Apache 2.

Is Apache-2.0 safe for commercial use?

Yes. Apache-2.0 is a permissive, OSI-approved license that grants a perpetual, worldwide, royalty-free right to reproduce, modify, distribute and sublicense the work, including in closed-source commercial products. There is no copyleft and no obligation to publish your own source. The conditions are attribution-shaped: keep the license and copyright notices, state significant changes you made, and pass along the NOTICE file if one exists.

What is the Apache-2.0 patent grant?

Section 3 of the license contains an express, irrevocable patent license from every contributor, covering the patent claims they own that are necessarily infringed by their contribution. MIT and the BSD licenses contain no such express grant. It also has a defensive termination clause: if you initiate patent litigation alleging that the work infringes a patent, your patent license under Apache-2.0 terminates. This is the main substantive reason organisations prefer Apache-2.0 over MIT.

What is the NOTICE file requirement?

If the work you received includes a NOTICE file, any derivative work you distribute must carry the attribution notices from it. This is a real, distinct obligation — you must propagate the upstream NOTICE content, not merely include the license text. In practice this means your distribution needs a third-party notices artifact that reproduces each Apache-2.0 dependency’s NOTICE content alongside its license.

Do I have to open-source my code if I use an Apache-2.0 dependency?

No. Apache-2.0 has no copyleft provision. Your own source can remain entirely proprietary and you may license your product on whatever terms you like. The obligations attach to the Apache-2.0 component you redistribute — its notices, its license text, and a statement of any significant modifications you made to it.

Is Apache-2.0 compatible with the GPL?

With GPL-3.0, yes — Apache-2.0 code can be combined into a GPL-3.0 project, and the combined work is distributed under the GPL-3.0. With GPL-2.0 it is not: the Free Software Foundation considers Apache-2.0’s patent and indemnification terms to be additional restrictions incompatible with GPL-2.0. This one-way, version-specific incompatibility is the most commonly missed compatibility trap in a mixed dependency tree.

What does Apache-2.0 add over a simpler permissive license?

Three things: an express patent grant with defensive termination, a requirement to state significant changes you made to the files, and the NOTICE-file propagation obligation. It also expressly withholds trademark rights. The trade is more explicit patent protection in exchange for a heavier attribution burden.

Audit your dependency licenses → All license guides

General information, not legal advice; confirm specific decisions with counsel. “Apache” and the Apache License refer to the license published by the Apache Software Foundation and are used nominatively.