diff --git a/apps/emqx/i18n/emqx_schema_i18n.conf b/apps/emqx/i18n/emqx_schema_i18n.conf
index 750c0c2cd..0665cfb09 100644
--- a/apps/emqx/i18n/emqx_schema_i18n.conf
+++ b/apps/emqx/i18n/emqx_schema_i18n.conf
@@ -2050,7 +2050,7 @@ base_listener_enable_authn {
 Set <code>true</code> (default) to enable client authentication on this listener, the authentication
 process goes through the configured authentication chain.
 When set to <code>false</code> to allow any clients with or without authentication information such as username or password to log in.
-When set to <code>quick_deny_anonymous<code>, it behaves like when set to <code>true</code> but clients will be
+When set to <code>quick_deny_anonymous</code>, it behaves like when set to <code>true</code>, but clients will be
 denied immediately without going through any authenticators if <code>username</code> is not provided. This is useful to fence off
 anonymous clients early.
 """
diff --git a/apps/emqx/src/emqx_schema.erl b/apps/emqx/src/emqx_schema.erl
index 4cd78b575..ed7e0a016 100644
--- a/apps/emqx/src/emqx_schema.erl
+++ b/apps/emqx/src/emqx_schema.erl
@@ -111,7 +111,7 @@
     comma_separated_atoms/0
 ]).
 
--export([namespace/0, roots/0, roots/1, fields/1, desc/1]).
+-export([namespace/0, roots/0, roots/1, fields/1, desc/1, tags/0]).
 -export([conf_get/2, conf_get/3, keys/2, filter/1]).
 -export([server_ssl_opts_schema/2, client_ssl_opts_schema/1, ciphers_schema/1]).
 -export([sc/2, map/2]).
@@ -120,6 +120,9 @@
 
 namespace() -> broker.
 
+tags() ->
+    [<<"EMQX">>].
+
 roots() ->
     %% TODO change config importance to a field metadata
     roots(high) ++ roots(medium) ++ roots(low).
@@ -2342,7 +2345,7 @@ authentication(Which) ->
             undefined -> hoconsc:array(typerefl:map());
             Module -> Module:root_type()
         end,
-    %% It is a lazy type because when handing runtime update requests
+    %% It is a lazy type because when handling runtime update requests
     %% the config is not checked by emqx_schema, but by the injected schema
     Type = hoconsc:lazy(Type0),
     #{
diff --git a/apps/emqx_authn/src/emqx_authn.app.src b/apps/emqx_authn/src/emqx_authn.app.src
index ea21e5bdc..7f01d94c0 100644
--- a/apps/emqx_authn/src/emqx_authn.app.src
+++ b/apps/emqx_authn/src/emqx_authn.app.src
@@ -1,7 +1,7 @@
 %% -*- mode: erlang -*-
 {application, emqx_authn, [
     {description, "EMQX Authentication"},
-    {vsn, "0.1.11"},
+    {vsn, "0.1.12"},
     {modules, []},
     {registered, [emqx_authn_sup, emqx_authn_registry]},
     {applications, [kernel, stdlib, emqx_resource, emqx_connector, ehttpc, epgsql, mysql, jose]},
diff --git a/apps/emqx_authn/src/emqx_authn_schema.erl b/apps/emqx_authn/src/emqx_authn_schema.erl
index 88d8955c5..f40e759f0 100644
--- a/apps/emqx_authn/src/emqx_authn_schema.erl
+++ b/apps/emqx_authn/src/emqx_authn_schema.erl
@@ -22,6 +22,7 @@
 -export([
     common_fields/0,
     roots/0,
+    tags/0,
     fields/1,
     authenticator_type/0,
     authenticator_type_without_scram/0,
@@ -32,6 +33,9 @@
 
 roots() -> [].
 
+tags() ->
+    [<<"Authentication">>].
+
 common_fields() ->
     [{enable, fun enable/1}].
 
diff --git a/apps/emqx_authn/src/enhanced_authn/emqx_enhanced_authn_scram_mnesia.erl b/apps/emqx_authn/src/enhanced_authn/emqx_enhanced_authn_scram_mnesia.erl
index ba13bd069..ac39e2cda 100644
--- a/apps/emqx_authn/src/enhanced_authn/emqx_enhanced_authn_scram_mnesia.erl
+++ b/apps/emqx_authn/src/enhanced_authn/emqx_enhanced_authn_scram_mnesia.erl
@@ -25,6 +25,7 @@
 
 -export([
     namespace/0,
+    tags/0,
     roots/0,
     fields/1,
     desc/1
@@ -105,6 +106,9 @@ mnesia(boot) ->
 
 namespace() -> "authn-scram-builtin_db".
 
+tags() ->
+    [<<"Authentication">>].
+
 roots() -> [?CONF_NS].
 
 fields(?CONF_NS) ->
diff --git a/apps/emqx_authn/src/simple_authn/emqx_authn_http.erl b/apps/emqx_authn/src/simple_authn/emqx_authn_http.erl
index 0a9aaa825..faa06b71a 100644
--- a/apps/emqx_authn/src/simple_authn/emqx_authn_http.erl
+++ b/apps/emqx_authn/src/simple_authn/emqx_authn_http.erl
@@ -26,6 +26,7 @@
 
 -export([
     namespace/0,
+    tags/0,
     roots/0,
     fields/1,
     desc/1,
@@ -51,6 +52,9 @@
 
 namespace() -> "authn-http".
 
+tags() ->
+    [<<"Authentication">>].
+
 roots() ->
     [
         {?CONF_NS,
diff --git a/apps/emqx_authn/src/simple_authn/emqx_authn_jwt.erl b/apps/emqx_authn/src/simple_authn/emqx_authn_jwt.erl
index 5709a1fe7..1c44b4d1f 100644
--- a/apps/emqx_authn/src/simple_authn/emqx_authn_jwt.erl
+++ b/apps/emqx_authn/src/simple_authn/emqx_authn_jwt.erl
@@ -25,6 +25,7 @@
 
 -export([
     namespace/0,
+    tags/0,
     roots/0,
     fields/1,
     desc/1
@@ -44,6 +45,9 @@
 
 namespace() -> "authn-jwt".
 
+tags() ->
+    [<<"Authentication">>].
+
 roots() ->
     [
         {?CONF_NS,
diff --git a/apps/emqx_authn/src/simple_authn/emqx_authn_mnesia.erl b/apps/emqx_authn/src/simple_authn/emqx_authn_mnesia.erl
index e915744e1..7c51644b7 100644
--- a/apps/emqx_authn/src/simple_authn/emqx_authn_mnesia.erl
+++ b/apps/emqx_authn/src/simple_authn/emqx_authn_mnesia.erl
@@ -26,6 +26,7 @@
 
 -export([
     namespace/0,
+    tags/0,
     roots/0,
     fields/1,
     desc/1
@@ -107,6 +108,9 @@ mnesia(boot) ->
 
 namespace() -> "authn-builtin_db".
 
+tags() ->
+    [<<"Authentication">>].
+
 roots() -> [?CONF_NS].
 
 fields(?CONF_NS) ->
diff --git a/apps/emqx_authn/src/simple_authn/emqx_authn_mongodb.erl b/apps/emqx_authn/src/simple_authn/emqx_authn_mongodb.erl
index 3fac0ed7d..3f140a8eb 100644
--- a/apps/emqx_authn/src/simple_authn/emqx_authn_mongodb.erl
+++ b/apps/emqx_authn/src/simple_authn/emqx_authn_mongodb.erl
@@ -25,6 +25,7 @@
 
 -export([
     namespace/0,
+    tags/0,
     roots/0,
     fields/1,
     desc/1
@@ -44,6 +45,9 @@
 
 namespace() -> "authn-mongodb".
 
+tags() ->
+    [<<"Authentication">>].
+
 roots() ->
     [
         {?CONF_NS,
diff --git a/apps/emqx_authn/src/simple_authn/emqx_authn_mysql.erl b/apps/emqx_authn/src/simple_authn/emqx_authn_mysql.erl
index 68913443f..ffce42bb3 100644
--- a/apps/emqx_authn/src/simple_authn/emqx_authn_mysql.erl
+++ b/apps/emqx_authn/src/simple_authn/emqx_authn_mysql.erl
@@ -27,6 +27,7 @@
 
 -export([
     namespace/0,
+    tags/0,
     roots/0,
     fields/1,
     desc/1
@@ -46,6 +47,9 @@
 
 namespace() -> "authn-mysql".
 
+tags() ->
+    [<<"Authentication">>].
+
 roots() -> [?CONF_NS].
 
 fields(?CONF_NS) ->
diff --git a/apps/emqx_authn/src/simple_authn/emqx_authn_pgsql.erl b/apps/emqx_authn/src/simple_authn/emqx_authn_pgsql.erl
index 1cadf9c56..2d7974301 100644
--- a/apps/emqx_authn/src/simple_authn/emqx_authn_pgsql.erl
+++ b/apps/emqx_authn/src/simple_authn/emqx_authn_pgsql.erl
@@ -26,6 +26,7 @@
 
 -export([
     namespace/0,
+    tags/0,
     roots/0,
     fields/1,
     desc/1
@@ -50,6 +51,9 @@
 
 namespace() -> "authn-postgresql".
 
+tags() ->
+    [<<"Authentication">>].
+
 roots() -> [?CONF_NS].
 
 fields(?CONF_NS) ->
diff --git a/apps/emqx_authn/src/simple_authn/emqx_authn_redis.erl b/apps/emqx_authn/src/simple_authn/emqx_authn_redis.erl
index 0c8fedfb5..12b7422b5 100644
--- a/apps/emqx_authn/src/simple_authn/emqx_authn_redis.erl
+++ b/apps/emqx_authn/src/simple_authn/emqx_authn_redis.erl
@@ -25,6 +25,7 @@
 
 -export([
     namespace/0,
+    tags/0,
     roots/0,
     fields/1,
     desc/1
@@ -44,6 +45,9 @@
 
 namespace() -> "authn-redis".
 
+tags() ->
+    [<<"Authentication">>].
+
 roots() ->
     [
         {?CONF_NS,
diff --git a/apps/emqx_authz/src/emqx_authz_schema.erl b/apps/emqx_authz/src/emqx_authz_schema.erl
index a684ae6ba..e2da9b41e 100644
--- a/apps/emqx_authz/src/emqx_authz_schema.erl
+++ b/apps/emqx_authz/src/emqx_authz_schema.erl
@@ -33,6 +33,7 @@
 -export([
     namespace/0,
     roots/0,
+    tags/0,
     fields/1,
     validations/0,
     desc/1
@@ -65,6 +66,9 @@ type_names() ->
 
 namespace() -> authz.
 
+tags() ->
+    [<<"Authorization">>].
+
 %% @doc authorization schema is not exported
 %% but directly used by emqx_schema
 roots() -> [].
diff --git a/apps/emqx_bridge/src/schema/emqx_bridge_schema.erl b/apps/emqx_bridge/src/schema/emqx_bridge_schema.erl
index 1ad5d7aba..845c1ef90 100644
--- a/apps/emqx_bridge/src/schema/emqx_bridge_schema.erl
+++ b/apps/emqx_bridge/src/schema/emqx_bridge_schema.erl
@@ -20,7 +20,7 @@
 
 -import(hoconsc, [mk/2, ref/2]).
 
--export([roots/0, fields/1, desc/1, namespace/0]).
+-export([roots/0, fields/1, desc/1, namespace/0, tags/0]).
 
 -export([
     get_response/0,
@@ -104,6 +104,9 @@ metrics_status_fields() ->
 
 namespace() -> "bridge".
 
+tags() ->
+    [<<"Bridge">>].
+
 roots() -> [bridges].
 
 fields(bridges) ->
diff --git a/apps/emqx_conf/src/emqx_conf_schema.erl b/apps/emqx_conf/src/emqx_conf_schema.erl
index a7b388964..71d2ab3fd 100644
--- a/apps/emqx_conf/src/emqx_conf_schema.erl
+++ b/apps/emqx_conf/src/emqx_conf_schema.erl
@@ -38,7 +38,9 @@
     cipher/0
 ]).
 
--export([namespace/0, roots/0, fields/1, translations/0, translation/1, validations/0, desc/1]).
+-export([
+    namespace/0, roots/0, fields/1, translations/0, translation/1, validations/0, desc/1, tags/0
+]).
 -export([conf_get/2, conf_get/3, keys/2, filter/1]).
 
 %% Static apps which merge their configs into the merged emqx.conf
@@ -67,6 +69,9 @@
 %% root config should not have a namespace
 namespace() -> undefined.
 
+tags() ->
+    [<<"EMQX">>].
+
 roots() ->
     PtKey = ?EMQX_AUTHENTICATION_SCHEMA_MODULE_PT_KEY,
     case persistent_term:get(PtKey, undefined) of
diff --git a/apps/emqx_gateway/src/emqx_gateway_schema.erl b/apps/emqx_gateway/src/emqx_gateway_schema.erl
index e89280f14..804e1f862 100644
--- a/apps/emqx_gateway/src/emqx_gateway_schema.erl
+++ b/apps/emqx_gateway/src/emqx_gateway_schema.erl
@@ -49,12 +49,15 @@
 ]).
 -elvis([{elvis_style, dont_repeat_yourself, disable}]).
 
--export([namespace/0, roots/0, fields/1, desc/1]).
+-export([namespace/0, roots/0, fields/1, desc/1, tags/0]).
 
 -export([proxy_protocol_opts/0]).
 
 namespace() -> gateway.
 
+tags() ->
+    [<<"Gateway">>].
+
 roots() -> [gateway].
 
 fields(gateway) ->
diff --git a/apps/emqx_rule_engine/src/emqx_rule_engine_schema.erl b/apps/emqx_rule_engine/src/emqx_rule_engine_schema.erl
index cbe7dae82..d6913cbc6 100644
--- a/apps/emqx_rule_engine/src/emqx_rule_engine_schema.erl
+++ b/apps/emqx_rule_engine/src/emqx_rule_engine_schema.erl
@@ -23,6 +23,7 @@
 
 -export([
     namespace/0,
+    tags/0,
     roots/0,
     fields/1,
     desc/1,
@@ -33,6 +34,9 @@
 
 namespace() -> rule_engine.
 
+tags() ->
+    [<<"Rule Engine">>].
+
 roots() -> ["rule_engine"].
 
 fields("rule_engine") ->
diff --git a/bin/nodetool b/bin/nodetool
index b4f0a0183..9a5d5e069 100755
--- a/bin/nodetool
+++ b/bin/nodetool
@@ -24,12 +24,19 @@ main(Args) ->
         ["hocon" | Rest] ->
             %% forward the call to hocon_cli
             hocon_cli:main(Rest);
-        ["check_license_key", Key] ->
-            check_license(#{key => list_to_binary(Key)});
+        ["check_license_key", Key0] ->
+            Key = cleanup_key(Key0),
+            check_license(#{key => Key});
         _ ->
             do(Args)
     end.
 
+%% the key is a string (list) representation of a binary, so we need
+%% to remove the leading and trailing angle brackets.
+cleanup_key(Str0) ->
+    Str1 = iolist_to_binary(string:replace(Str0, "<<", "", leading)),
+    iolist_to_binary(string:replace(Str1, ">>", "", trailing)).
+
 do(Args) ->
     ok = do_with_halt(Args, "mnesia_dir", fun create_mnesia_dir/2),
     ok = do_with_halt(Args, "chkconfig", fun("-config", X) -> chkconfig(X) end),
diff --git a/lib-ee/emqx_license/src/emqx_license_schema.erl b/lib-ee/emqx_license/src/emqx_license_schema.erl
index bde4ed076..9d16f697c 100644
--- a/lib-ee/emqx_license/src/emqx_license_schema.erl
+++ b/lib-ee/emqx_license/src/emqx_license_schema.erl
@@ -13,7 +13,7 @@
 
 -behaviour(hocon_schema).
 
--export([roots/0, fields/1, validations/0, desc/1]).
+-export([roots/0, fields/1, validations/0, desc/1, tags/0]).
 
 -export([
     default_license/0,
@@ -31,10 +31,13 @@ roots() ->
             )}
     ].
 
+tags() ->
+    [<<"License">>].
+
 fields(key_license) ->
     [
         {key, #{
-            type => string(),
+            type => binary(),
             default => default_license(),
             %% so it's not logged
             sensitive => true,
@@ -82,7 +85,9 @@ check_license_watermark(Conf) ->
 %% NOTE: when updating a new key, the schema doc in emqx_license_schema_i18n.conf
 %% should be updated accordingly
 default_license() ->
-    "MjIwMTExCjAKMTAKRXZhbHVhdGlvbgpjb250YWN0QGVtcXguaW8KZ"
-    "GVmYXVsdAoyMDIzMDEwOQoxODI1CjEwMAo=.MEUCIG62t8W15g05f"
-    "1cKx3tA3YgJoR0dmyHOPCdbUxBGxgKKAiEAhHKh8dUwhU+OxNEaOn"
-    "8mgRDtiT3R8RZooqy6dEsOmDI=".
+    <<
+        "MjIwMTExCjAKMTAKRXZhbHVhdGlvbgpjb250YWN0QGVtcXguaW8KZ"
+        "GVmYXVsdAoyMDIzMDEwOQoxODI1CjEwMAo=.MEUCIG62t8W15g05f"
+        "1cKx3tA3YgJoR0dmyHOPCdbUxBGxgKKAiEAhHKh8dUwhU+OxNEaOn"
+        "8mgRDtiT3R8RZooqy6dEsOmDI="
+    >>.