Skip to main content
The InFlow CLI is a signed native application. It gives an agent discovery with ODP, enrollment with AEP, and payments with MPP and x402.

​
Supported platforms

The Linux installer supports Debian, Ubuntu, Fedora, and RHEL with systemd. It needs gpgv, and root or sudo access.

​
Install the CLI

On Windows, run PowerShell as a user who can approve the Windows Installer admin prompt. Check the installed version.
Do not install the CLI from npm. The @inflowpayai/inflow npm package is only a compatibility notice. It does not run commands, start MCP, or manage credentials.
Homebrew (macOS)
WinGet (Windows)
Compatibility endpoint. It selects the correct installer on macOS, on Linux, and in Git Bash on Windows.
Direct download. Each GitHub Release has one file for each platform.Linux releases include Debian packages, RPM packages, and standalone archives for ARM64 and AMD64. The macOS zip file contains InFlow.app, with the executable at InFlow.app/Contents/MacOS/inflow.

​
What the installer does

The installer checks each package before it installs it.

​
Upgrade the CLI

Run the installer again. It installs the latest GitHub Release.
When a newer version is available, the inflow auth status response contains an update field.

​
Unlock the vault

The CLI keeps OAuth tokens, API keys, and service credentials in an encrypted local vault. Initialize the vault before the first command that uses a credential.
The command asks for a PIN or a passphrase. The CLI reads it only from the terminal, never from an MCP argument, a flag, an environment variable, or agent input.
Run inflow vault unlock yourself, in your own terminal. Never give the PIN or the passphrase to an agent.
When the vault is locked, a command from an agent returns a human-action error. Only the owner can unlock the vault.

​
Manage the vault

status, lock, and policy do not need the PIN or the passphrase. set-policy accepts two flags. --idle-timeout-seconds locks the vault after that many idle seconds. 0 disables the idle timeout. --lock-on-sleep locks the vault when the computer sleeps.
inflow vault reset --force deletes every credential in the vault. After a reset, log in again. Then run inflow aep status for each service. If a service shows no enrollment, enroll again.

​
Stop update checks

Set NO_UPDATE_NOTIFIER=1 to stop the version checks.

​
Uninstall the CLI

The Windows installer keeps the encrypted vault data when it uninstalls the CLI.

​
Next step

Authenticate

Log the agent in with the device flow or with an API key.
Last modified on October 15, 2026