SPDX License Identifiers and File Headers — Including the REUSE Approach

What is SPDX?

SPDX (Software Package Data Exchange) is a Linux Foundation project and a standard for expressing software components and license information in a machine-readable way. In 2021 it became the international standard ISO/IEC 5962:2021. Its most widely used part is the short identifiers of the SPDX License List: an agreement to write just MIT instead of assorted names like "MIT License", "The MIT license" or "MIT licence".

Two header lines

Put the following two lines as comments at the top of a source file, and both people and tools can immediately see the file's copyright holder and license.

// SPDX-FileCopyrightText: 2026 Jane Doe <jane@example.com>
// SPDX-License-Identifier: MIT

SPDX-License-Identifier holds a license identifier or expression (MIT OR Apache-2.0).
SPDX-FileCopyrightText is the copyright notice. For multiple holders, use multiple lines.
The Linux kernel adopted this one-line approach in place of long license notices in 2017, cutting thousands of lines of duplicated boilerplate.

The generator's File header tab creates these two lines in seven comment styles.

Watch out for deprecated identifiers

Since SPDX License List 3.0 (December 2017), identifiers for GNU licenses must reveal the version clause.

Deprecated identifier	Current identifier
`GPL-2.0`	`GPL-2.0-only`
`GPL-2.0+`	`GPL-2.0-or-later`
`GPL-3.0`	`GPL-3.0-only`
`LGPL-2.1`	`LGPL-2.1-only`
`AGPL-3.0`	`AGPL-3.0-only`

Writing just GPL-3.0 does not tell you whether it is "only" or "or later". The difference between the two is explained in only vs or-later.

Package metadata

Most package managers accept SPDX identifiers or expressions.

Ecosystem	File	Example
npm	`package.json`	`"license": "MIT"` · `"UNLICENSED"` for private
Rust	`Cargo.toml`	`license = "MIT OR Apache-2.0"`
Python	`pyproject.toml`	`license = "Apache-2.0"` (PEP 639)
Maven	`pom.xml`	Name and URL inside `<licenses>`

npm's UNLICENSED means something completely different from "Unlicense": it marks a private package whose use is not permitted. The spellings are similar, so mistakes are common.

REUSE: making the whole repository machine-readable

The REUSE specification from the Free Software Foundation Europe (FSFE) defines how to apply SPDX headers consistently across a repository.

Put every license text in a LICENSES/ folder named SPDX-identifier.txt (e.g. LICENSES/MIT.txt).
Add SPDX-FileCopyrightText and SPDX-License-Identifier to each file.
For files that cannot contain comments (images, JSON, etc.), provide the information in a filename.license sidecar file or in a REUSE.toml at the repository root.
Use the reuse lint tool to check that no files are missing.

Practical tips

Identifiers are case-sensitive; write them exactly as listed (Apache-2.0, not apache2).
Write custom licenses not on the list with the LicenseRef- prefix (e.g. LicenseRef-Proprietary).
An identifier alone without the full text is hardly enough to satisfy notice obligations. Keep the license text in a separate file.

This article is general information, not legal advice. Consult a professional for important decisions.

Sources

SPDX License List — https://spdx.org/licenses/
SPDX Specification, Annex: Using SPDX short identifiers in source files — https://spdx.github.io/spdx-spec/v2.3/using-SPDX-short-identifiers-in-source-files/
REUSE Specification — https://reuse.software/spec/
npm Docs, package.json license — https://docs.npmjs.com/cli/configuring-npm/package-json#license
PEP 639 — https://peps.python.org/pep-0639/