Skip to content
authtoken

Download atok

atok is the command-line client. One command installs it; the archives and their checksums are right here for anyone who would rather look before they run something.

Current version v0.12.0

Install with one command

The script detects your platform, reads the current version, downloads the archive, checks it against SHA256SUMS before unpacking anything, and installs to ~/.local/bin. It never runs sudo and never edits a shell startup file — it prints the PATH line for you to paste.

curl -fsSL https://authtoken.com/install.sh | sh

Read install.sh before you run it

To pin a version, or to install somewhere else:

curl -fsSL https://authtoken.com/install.sh | sh -s -- --version v0.12.0curl -fsSL https://authtoken.com/install.sh | sh -s -- --bin-dir /usr/local/bin

Or download it and check it yourself

Piping a script into a shell is a reasonable thing to refuse, and on this product that reader is the expected one rather than the exception. These lines do what the script does, with nothing between you and the bytes.

curl -fsSLO https://authtoken.com/dl/v0.12.0/atok_v0.12.0_linux_amd64.tar.gzcurl -fsSLO https://authtoken.com/dl/v0.12.0/SHA256SUMSsha256sum --ignore-missing -c SHA256SUMStar -xzf atok_v0.12.0_linux_amd64.tar.gzinstall -m 0755 atok ~/.local/bin/atokatok version

--ignore-missing checks the one archive you downloaded; SHA256SUMS lists all four of them. Substitute the platform you are on.

What the checksum proves, and what it does not

It proves

SHA256SUMS proves the bytes you received are the bytes this release published. It catches a truncated download, a corrupted one, and a mirror that altered the archive on its way to you.

It does not prove

It does not prove where the release came from. Anyone who controlled this origin could serve an altered archive together with a SHA256SUMS that matches it, and the check would pass. A checksum published beside the file it describes is an integrity check, not a signature.

So: the archives are not code-signed and SHA256SUMS carries no signature. Release tags are unsigned too, and signing the artifacts while the tag they are built from is unsigned would move no attacker. If that changes, the tags and the artifacts get one key between them, not two.

Direct downloads

Every published version keeps its own URL for good — nothing here is pruned, so an install that was pinned once can be repeated.

Windows

The zip holds atok.exe, flat: unpack it somewhere on your PATH and run it from PowerShell or cmd. Expect SmartScreen. The binary is not code-signed, so Windows shows its blue “Windows protected your PC” screen the first time and running it means choosing More info, then Run anyway. There is no installer and no winget package — that is the same unsigned-binary question as the macOS one, and it is not answered yet.

macOS is not built yet

There is no darwin archive, and that is a decision rather than an upload that has not happened. An unsigned, unnotarized binary is stopped by Gatekeeper and asks for keychain access again after every update, which is worse than no build at all. Signing and notarization need an Apple developer account that does not exist yet. When it does, macOS joins the list above; until then, build it from source.

Building it from source

Go 1.26 or newer — the wrap layer uses crypto/hpke from the standard library, which is new in 1.26. The source is not public today: the product is in closed beta and so is the repository, so this path is open to whoever already has a checkout.

cd cli && go build -o atok ./cmd/authtoken

A binary built this way reports version dev instead of a release version. That is the predicate install.sh and the release build use to tell the two apart, and it is deliberate: an unstamped build is not a release.