Get the nfltr command-line client for the hosted control plane at nfltr.xyz. Pick your platform, paste the one-liner, then save your API key from the dashboard.
Recommended: one-line installer (downloads the latest binary, checks the release's signed SHA256SUMS and the binary's SHA-256, and refuses it on a missing or bad signature or a mismatch):
curl -fsSL https://nfltr.xyz/install.sh | shConfirm: nfltr version. For the hub, nodes and MCP (nfltr orch, nfltr node), add nfltr-orch: curl -fsSL https://nfltr.xyz/install.sh | sh -s -- --with orch (or nfltr update --apply --with orch).
One-line installer for amd64 and arm64 (checks the signature and SHA-256 the same way):
curl -fsSL https://nfltr.xyz/install.sh | shOverride install directory with NFLTR_INSTALL_DIR=/usr/local/bin if needed.
Download the latest nfltr.exe for your architecture from the dashboard downloads page, add the folder to your PATH, then open PowerShell:
nfltr versionEach release folder has a SHA256SUMS file, signed by the nfltr release key (SHA256SUMS.sshsig); compare it with certutil -hashfile nfltr-windows-amd64.exe SHA256. nfltr update --apply checks the signature and checksum itself.
Sign in with your browser; a new API key is saved locally and never printed:
nfltr config loginOn a machine without a browser, create a key at nfltr.xyz/dashboard under Account → API keys, then store it locally (the key is prompted for without echo, so it stays out of shell history; pipe it with nfltr config add-api-key - in scripts) so every nfltr orch command authenticates to the hosted plane:
nfltr config add-api-keyOptional label for a teammate key: nfltr config add-api-key --name alice