Document static license support for the pro CLI plugin

Add pro plugin installation and activation instructions to the CLI
install page, including static license and GitHub activation methods.

Update deployment and SSO pages to reference the central
install page instead of duplicating instructions.

Signed-off-by: Han Verstraete (OpenFaaS Ltd) <han@openfaas.com>

Author: welteki

docs/cli/install.md

@@ -56,6 +56,54 @@ $version = (Invoke-WebRequest "https://api.github.com/repos/openfaas/faas-cli/re
 (New-Object System.Net.WebClient).DownloadFile("https://github.com/openfaas/faas-cli/releases/download/$version/faas-cli.exe", "faas-cli.exe")
 ```
 
+## Pro plugin
+
+The OpenFaaS Pro CLI plugin provides additional features for the faas-cli including [SSO and OIDC authentication](/openfaas-pro/sso/cli).
+
+> Note: The pro plugin is available for [OpenFaaS Standard & For Enterprises](https://openfaas.com/pricing/) customers and requires activation.
+
+Download the pro plugin:
+
+```bash
+faas-cli plugin get pro
+```
+
+### Activate with a static license
+
+If you have a static JWT license for the CLI, you can enable the plugin without any interactive steps. This is the recommended approach for CI/CD pipelines and air-gapped environments.
+
+Save the license to the default location. Run the following, then paste in your license, hit enter once, then Control + D to save the file.
+
+```bash
+mkdir -p ~/.openfaas
+cat > ~/.openfaas/LICENSE_CLI
+```
+
+Once the license is in place, the plugin is enabled automatically and no additional flags or environment variables are needed.
+
+The license can also be provided through alternative sources. They are resolved in the following priority order:
+
+1. `--license` flag — literal JWT string
+2. `--license-file` flag — path to a file containing the JWT
+3. `OPENFAAS_LICENSE` environment variable
+4. Default file at `$HOME/.openfaas/LICENSE_CLI`
+
+Contact the OpenFaaS team to obtain a static license for the CLI.
+
+### Activate with GitHub
+
+For customers who have a GitHub organisation, you will need to send the OpenFaaS team an email with the name of the organisation, and make sure you can log into your account.
+
+```bash
+faas-cli pro enable
+```
+
+A browser will open with a device challenge, once completed, the CLI will be enabled.
+
+!!! note "Does your team not have a GitHub organisation available?"
+
+    If your organisation does not use GitHub, or you are not a member of its GitHub organisation, you can use a [static license](#activate-with-a-static-license) instead.
+
 ## Environment variable overrides
 
 Several overrides exist which will be used by default if set and no other command-line flag has been set.

docs/deployment/pro.md

@@ -206,16 +206,9 @@ Learn more:
 
 ### OpenFaaS Pro CLI
 
-The OpenFaaS Pro CLI provides additional functionality on top of faas-cli, such as build-time secrets, and a `local-run` command to try out functions without deploying them.
+The OpenFaaS Pro CLI plugin provides additional features for the faas-cli including SSO and OIDC authentication.
 
-```bash
-faas-cli plugin get pro
-faas-cli pro enable
-```
-
-You'll need a GitHub account in your company's GitHub organisation to use this feature. If you cannot get one for some reason, or use GitLab, please let us know and we'll provide an alternative mechanism to activate the CLI.
-
-See also: [faas-cli installation](/cli/install)
+See: [Pro plugin installation](/cli/install/#pro-plugin)
 
 ### Function Builder API
 

docs/openfaas-pro/sso/cli.md

@@ -2,36 +2,12 @@
 
 For customers who have enabled IAM for OpenFaaS, OIDC can be used to authenticate the CLI. An initial token will be obtained from your Identity Provider (IdP) and then it will be exchanged for an OpenFaaS access token.
 
-You'll need to start off by installing the faas-cli, if you don't have it yet, [it's available on GitHub](https://github.com/openfaas/faas-cli/releases).
+You'll need to start off by installing the faas-cli and the pro plugin. See: [CLI Installation](/cli/install) and [Pro plugin](/cli/install/#pro-plugin).
 
 !!! note "Do you want to run faas-cli from a server instead of as a human user?"
 
     SSO and OIDC are primarily designed for interactive use by a human user in front of a keyboard, with a web-browser available. If you need to use an OAuth token to authenticate server-to-server, then you you'll need to create a new OAuth client in your IdP, and then use the `--client-secret` flag with the `faas-cli pro auth` command. 
 
-### Download the pro plugin
-
-First, download the `pro` plugin which enables SSO using OIDC:
-
-```bash
-faas-cli plugin get pro
-```
-
-### Enable the plugin
-
-Only authorized use of the plugin is permitted, so you will need to enable it now.
-
-Next, for customers who have a GitHub organisation, you will need to send the OpenFaaS team an email with the name of the organisation, and make sure you can log into your account.
-
-```bash
-faas-cli pro enable
-```
-
-A browser will open with a device challenge, once completed, the CLI will be enabled.
-
-!!! note "Does your team not have a GitHub organisation available?"
-
-    If your organisation does not use GitHub, or you are not a member of its GitHub organisation, there is an alternative approach to enabling the plugin. Email the OpenFaaS team for the details.
-
 ### Log into the gateway using SSO
 
 Now you can log into the gateway using one of the defined JwtIssuers for your installation. If you have not defined a JwtIssuer yet, then see the overview post here: [Walkthrough of Identity and Access Management (IAM) for OpenFaaS](https://www.openfaas.com/blog/walkthrough-iam-for-openfaas/).