# Install & sign in

Get the one9x binary on macOS, Linux or Windows, sign in once, and mint a machine token for CI.

The CLI is a single static binary — the same `one9x` binary used across every
One9x product, with Pages as a subcommand group. Install it, then sign in once
to link the CLI to your account.

## macOS and Linux

```console title="install & sign in"
$ curl -fsSL https://get.one9x.com | sh
installed one9x → /usr/local/bin
$ one9x login
opening browser to authorize …
✓ signed in as you@example.com
```

The installer is a shell script and drops the binary in `/usr/local/bin`.

## Windows

```console title="powershell"
$ irm https://get.one9x.com/install.ps1 | iex
installing one9x (windows/amd64) …
✓ one9x.exe → %LOCALAPPDATA%\Programs\one9x
$ one9x login
✓ signed in as you@example.com
```

It drops `one9x.exe` in `%LOCALAPPDATA%\Programs\one9x` and adds it to your PATH
— no admin rights needed, and it works in the same terminal.

## Placing the binary yourself

The binaries are plain downloads —
`get.one9x.com/<version>/one9x-windows-amd64.exe` (or `-arm64`), with the
current version at `get.one9x.com/VERSION`. macOS and Linux builds sit alongside
them under the same paths.

## Signing in

`one9x login` authorizes the CLI against your One9x account and stores a token
locally — there's no API key to copy around, and it renews itself so you sign in
once per machine. Every Pages command runs as you, against your sites.

On a server with no browser, add `--no-browser` and approve the printed URL from
any other device.

> You need an account before the CLI can log in. [Create
> one](https://portal.one9x.com/register), confirm your email, then run `one9x
> login`.

## Machine tokens, for CI and agents

For CI, cron and agents, mint a machine token instead of logging in. Set it as
`ONE9X_TOKEN` and every command authenticates with no browser:

```console title="ci"
$ one9x tokens create "ci"
one9x_tok_7Kd…  (shown once)
$ export ONE9X_TOKEN=one9x_tok_…
$ one9x pages release ./dist --site mysite --deploy
✓ deployed
```

The token is printed once and then hashed — store it when you see it, because it
can never be shown again.

**Tokens last 90 days by default** (`--expires-in` to choose, up to a year). That
is the single most likely way a working pipeline stops working, so it is worth
knowing the fix before you need it: `one9x tokens extend <id>` pushes the expiry
out *without* changing the secret, so CI keeps running with the value it already
has. `one9x tokens list` shows what exists, when each was last used and when it
expires; `one9x tokens revoke <id>` kills one immediately.

If you are wiring up GitHub Actions, the token goes in a repository or
organization secret — see [GitHub Actions](/docs/github-actions).