I'm creating an API for a website. An interesting Node.js package I would need is licensed under the AGPL-3. that package is a binding library that speaks to a GPL-2 licensed software (compiled binary).
I searched for quite some time and I wasn't confident about my understanding of the AGPL and GPL license with how I would need to use them - too many different interpretation of both licenses it seem.
Both the software and the package would be on the same machine. The client (website) sends a request to the server. The server uses the AGPL library to get some results, might change/adjust/add or remove values and then send the data to the website.
I've read, for both license that I may, or may not need to disclose the code. I read both licenses but I get lost and confused very rapidly. I put my understanding further down below.
Rephrasing everything to be safe:
- Website calls API
- API includes multiple things/services and only a subset of resources/a single service need this package (and therefore this software)
- API uses package to determine some values.
- Package calling the software is AGPL 3.
- Software is GPL 2
- Data is returned to the API
- The API might make some corrections
- Data is returned to the website
Some statements - to be extra clear:
- I will not make modification to the Node.js package or the software it's calling
- I will allow free access to the website (rate limited)
- I will not allow access to the API to the public (the website still need to call the API)
- I would maybe charge a small amount to access some part of the website, eventually
- I would like to maybe allow access to the API (rate limited/free tier and paid tier) in the future.
- The API is vast and cover a lot of various services. The package above would only by a single service.
- The API (the fastify server) is a single source code right now
Questions - If my understanding is wrong:
- a)Which license in this requires me to open-source the REST API source code?
- b)What would change if the package was LGPL-3.0?
- Do I need to open-source the website?
- Not to sound harsh, but if I do need to open-source the REST API, what can I do to either not do it (except not using the package and/or software) or limit what will be open-source?
- Any other considerations, notes or tips?
(This was longer than intended, sorry. Editors feel free to clean this up if needed - thank you)