Skip to content
authtoken

Download atok

atok is the command-line client. One command installs it; the archives and their checksums are right here for anyone who would rather look before they run something.

Current version v0.20.1

Install with one command

The script detects your platform, reads the current version, downloads the archive, checks it against SHA256SUMS before unpacking anything, and installs to ~/.local/bin. It never runs sudo and never edits a shell startup file — it prints the PATH line for you to paste.

curl -fsSL https://authtoken.com/install.sh | sh

Read install.sh before you run it

To pin a version, or to install somewhere else:

curl -fsSL https://authtoken.com/install.sh | sh -s -- --version v0.20.1curl -fsSL https://authtoken.com/install.sh | sh -s -- --bin-dir /usr/local/bin

Or download it and check it yourself

Piping a script into a shell is a reasonable thing to refuse, and on this product that reader is the expected one rather than the exception. These lines do what the script does, with nothing between you and the bytes.

curl -fsSLO https://authtoken.com/dl/v0.20.1/atok_v0.20.1_linux_amd64.tar.gzcurl -fsSLO https://authtoken.com/dl/v0.20.1/SHA256SUMSsha256sum --ignore-missing -c SHA256SUMStar -xzf atok_v0.20.1_linux_amd64.tar.gzinstall -m 0755 atok ~/.local/bin/atokatok version

--ignore-missing checks the one archive you downloaded; SHA256SUMS lists all four of them. Substitute the platform you are on.

What the checksum proves, and what it does not

It proves

SHA256SUMS proves the bytes you received are the bytes this release published. It catches a truncated download, a corrupted one, and a mirror that altered the archive on its way to you.

It does not prove

It does not prove where the release came from. Anyone who controlled this origin could serve an altered archive together with a SHA256SUMS that matches it, and the check would pass. A checksum published beside the file it describes is an integrity check, not a signature.

So: the archives are not code-signed. Releases up to and including v0.16.0 have the checksum and nothing more. Every release after v0.16.0 also publishes SHA256SUMS.sig, an SSH signature over SHA256SUMS by the same key that signs its release tag, and install.sh checks it with the public key it carries when an ssh-keygen that can verify (OpenSSH 8.1 or later) is on the machine, refusing a release that should have one and does not; without one it says so and checks the checksum alone. That signature moves trust from this origin to that key. It does not cover install.sh itself, which comes from this same origin: it is as trustworthy as the copy you ran.

Direct downloads

Every published version keeps its own URL for good — nothing here is pruned, so an install that was pinned once can be repeated.

Windows

The zip holds atok.exe, flat: unpack it somewhere on your PATH and run it from PowerShell or cmd. Expect SmartScreen. The binary is not code-signed, so Windows shows its blue “Windows protected your PC” screen the first time and running it means choosing More info, then Run anyway. There is no installer and no winget package — that is the same unsigned-binary question as the macOS one, and it is not answered yet.

macOS is not built yet

There is no darwin archive, and that is a decision rather than an upload that has not happened. An unsigned, unnotarized binary is stopped by Gatekeeper and asks for keychain access again after every update, which is worse than no build at all. Signing and notarization need an Apple developer account that does not exist yet. When it does, macOS joins the list above; until then, build it from source.