Running in about a minute.

Install

One line downloads the right binary for your machine, verifies it against the published checksums, and installs it:

curl -fsSL https://switchtender.com/install.sh | sh

Prefer not to pipe to a shell? Every release ships cosign-signed checksums and SBOMs: verify a release in your browser or with cosign, then run the binary you checked.

Or grab a prebuilt binary yourself. No toolchain required. Every release ships macOS, Linux, and Windows builds you can download and run.

Pick the build for your platform: the .dmg or a darwin tarball on macOS, a linux tarball on Linux, or the windows zip. Verify it against the SHA256SUMS file on the same release.

Prefer to build from source? With the Go toolchain installed:

go install github.com/kordloom/switchtender@latest

To run Ansible you also need ansible-playbook on the box. Terraform, OpenTofu, Python, and Go runs each need their own toolchain. Bash and PowerShell use what the OS already provides.

Serve

Start the server. SQLite is the default. Point --db at a Postgres DSN when you want more than one instance. Set the encryption pair if you plan to store credentials. On a public address with no tokens yet, serve mints your initial admin token and prints it once, so the API requires auth from its very first request; only loopback may run open, and it says so.

# optional, only needed for stored secrets
export SWITCHTENDER_ENCRYPTION_KEY=change-me
export SWITCHTENDER_ENCRYPTION_SALT=change-me-too

switchtender serve --addr :8080 --db switchtender.db

Open the UI

The whole interface lives at /ui/. Sign in with the admin token serve just printed: pick Use an API token instead on the login page and paste it. This is where you launch runs and read them as a live host-by-task matrix.

open http://localhost:8080/ui/

Launch your first run

Click Launch run in the UI, or fire one over the API with the token from step 2. No Ansible required for this one. It's a plain Bash run you can watch stream live.

# the admin token serve printed at startup
export ST_TOKEN=paste-it-here

curl -s -X POST localhost:8080/v1/runs \
  -H "authorization: Bearer $ST_TOKEN" \
  -H 'content-type: application/json' \
  -d '{"tool":"bash","command":"echo hello from switchtender"}'

Name your tokens

The server never listens openly on a network interface: step 2 already minted your initial admin token. Now mint named tokens for each person and each CI job, send them as bearer tokens, and retire the initial one so every credential in the audit trail names its owner.

switchtender token new --name admin --db switchtender.db
switchtender token revoke <initial-token-id> --db switchtender.db