Skip to main content

CLI Installation

The Approov CLI is the main tool for managing your Approov account. You use it to initialize account access, add API domains, add app signing certificates, manage users, and configure security settings.

Requirements​

Before installing the CLI, you need:

  • An Approov account. You can sign up for a free trial.
  • The Approov Onboarding email for your account or assigned user role.
  • A supported operating system: Linux, macOS, or Windows.
  • Access to either the direct CLI download or the Brew package manager.

All examples in the documentation assume the approov command is available on your PATH.

Install the CLI​

Choose the operating system you are installing on.

Download the Approov CLI package and copy the approov executable from the Linux directory into a directory on your PATH.

Common locations are:

~/bin
~/.local/bin
/usr/local/bin

If you install the executable into a custom directory, add that directory to your shell profile. For example:

PATH=~/approov-tool:$PATH

Then reload the shell configuration:

source ~/.bashrc

Install with Brew​

For Linux or macOS, you can install the Approov CLI with Brew:

brew update
brew install approov/cli/approov

If a new version becomes available, update it with:

brew upgrade approov

Use Brew if you already manage development tools with it. Otherwise, the direct download is a perfectly valid installation path.

If a new version of the CLI becomes available, the CLI displays an upgrade message when you run it. Follow the link in that message if you installed from the direct download package.

Initialize the Approov CLI​

Initialize CLI access using the command from your Approov Onboarding email. It will look similar to this:

approov init your-account 542f15e4-6224-43c2-8e4b-015c5a5251cd

The first parameter is your Approov account name. The second parameter is a time-limited onboarding code.

During initialization, the CLI may ask you to set a password. It will also show a recovery PIN:

IMPORTANT: your recovery PIN is 287572 - make a note of this in case you ever need to recover your access
please provide a password (6 characters or more) to protect access
enter password:
confirm password:
approov access has been initialized
available role selection commands for account your-account:
  eval `approov role admin`
  eval `approov role dev`

Store the recovery PIN privately and securely. You need it if you ever lose all account access and must recover access by email.

If you are the account owner, initialization usually grants both dev and admin roles. Most day-to-day commands use dev; sensitive account operations require admin.

tip

If you are setting up Approov on another machine and the original onboarding email has expired, ask a user with the right permissions to resend an onboarding email. See Resending Onboarding Emails.

tip

If you were issued an older Approov management token before account access roles were introduced, you can import it with approov init -import. See Init Command for the exact syntax.

tip

A wrong recovery attempt "silently fails" (no indication given) and you must wait 5 minutes before retrying due to PIN brute-force protection.

Verify CLI Access​

Check that the CLI is installed and your role is available:

approov whoami

This prints the current account, role, user identity, and role expiry information.

To list the roles installed on your machine:

approov role

On Linux and macOS, switch roles with the command shown by approov role, for example:

eval `approov role admin`

On Windows, use the set APPROOV_ROLE=... command shown in the output.