Install the Gateway

Install the kt CLI, verify the local environment, and move into a working gateway setup.

Regional installers

Use the regional installer when you want a guided install pinned to the exact regional release host you choose.

Region	macOS and Linux	Windows PowerShell	Release base
EU	https://get.eu.keeptrusts.com/install.sh	https://get.eu.keeptrusts.com/install.ps1	https://dl.eu.keeptrusts.com/releases/latest
US	https://get.us.keeptrusts.com/install.sh	https://get.us.keeptrusts.com/install.ps1	https://dl.us.keeptrusts.com/releases/latest

macOS or Linux

Download the regional installer, inspect it, and then run the local copy:

INSTALLER="$(mktemp)"
curl -fsSL https://get.eu.keeptrusts.com/install.sh -o "$INSTALLER"
less "$INSTALLER"
sh "$INSTALLER"
rm "$INSTALLER"

The hosted installer downloads the platform binary and its published SHA-256 file from the same regional release base, rejects a checksum mismatch, installs kt, and attempts to register a background gateway service. On macOS that is a LaunchDaemon or LaunchAgent. On Linux it is a systemd service when systemd and the required privileges are available. Regional installers fail closed against their own dl.<region>.keeptrusts.com release bucket and do not fall back across regions.

Install only the binary without background-service setup:

INSTALLER="$(mktemp)"
curl -fsSL https://get.eu.keeptrusts.com/install.sh -o "$INSTALLER"
less "$INSTALLER"
sh "$INSTALLER" --no-service
rm "$INSTALLER"

On Linux service installs, runtime env values such as KEEPTRUSTS_API_URL, KEEPTRUSTS_API_TOKEN, and the optional agent selector are written to /etc/keeptrusts/keeptrusts-kt.env and loaded by the keeptrusts-kt systemd unit.

Windows

$installer = Join-Path $env:TEMP "keeptrusts-install.ps1"
Invoke-WebRequest -Uri "https://get.eu.keeptrusts.com/install.ps1" -OutFile $installer
Get-Content $installer
powershell.exe -ExecutionPolicy Bypass -File $installer
Remove-Item $installer

The PowerShell installer downloads the Windows binary and its SHA-256 file from the chosen region and stops if the hashes differ.

If you need a staged release bucket, set KEEPTRUSTS_INSTALL_RELEASE_BASE to the exact regional staged release base before running the installer.

Direct downloads

Choose one regional release base before downloading artifacts. Direct downloads do not switch regions automatically.

macOS

brew install keeptrusts/tap/kt

Or download the current disk image directly:

RELEASE_BASE="https://dl.eu.keeptrusts.com/releases/latest" # or https://dl.us.keeptrusts.com/releases/latest
curl -fsSLO "${RELEASE_BASE}/kt-macos-universal.dmg"
EXPECTED_SHA256="$(curl -fsSL "${RELEASE_BASE}/manifest.json" | jq -r '.artifacts[] | select(.filename == "kt-macos-universal.dmg") | .sha256')"
ACTUAL_SHA256="$(shasum -a 256 kt-macos-universal.dmg | awk '{print $1}')"
test -n "$EXPECTED_SHA256" && test "$EXPECTED_SHA256" != "null" && test "$ACTUAL_SHA256" = "$EXPECTED_SHA256"
hdiutil attach kt-macos-universal.dmg
cp /Volumes/Keeptrusts\ Gateway/kt /usr/local/bin/kt
hdiutil detach /Volumes/Keeptrusts\ Gateway

Linux (x86_64)

RELEASE_BASE="https://dl.eu.keeptrusts.com/releases/latest" # or https://dl.us.keeptrusts.com/releases/latest
curl -fsSLO "${RELEASE_BASE}/kt-linux-x86_64.deb"
EXPECTED_SHA256="$(curl -fsSL "${RELEASE_BASE}/manifest.json" | jq -r '.artifacts[] | select(.filename == "kt-linux-x86_64.deb") | .sha256')"
ACTUAL_SHA256="$(sha256sum kt-linux-x86_64.deb | awk '{print $1}')"
test -n "$EXPECTED_SHA256" && test "$EXPECTED_SHA256" != "null" && test "$ACTUAL_SHA256" = "$EXPECTED_SHA256"
sudo dpkg -i kt-linux-x86_64.deb

Or use the RPM package:

RELEASE_BASE="https://dl.eu.keeptrusts.com/releases/latest" # or https://dl.us.keeptrusts.com/releases/latest
curl -fsSLO "${RELEASE_BASE}/kt-linux-x86_64.rpm"
EXPECTED_SHA256="$(curl -fsSL "${RELEASE_BASE}/manifest.json" | jq -r '.artifacts[] | select(.filename == "kt-linux-x86_64.rpm") | .sha256')"
ACTUAL_SHA256="$(sha256sum kt-linux-x86_64.rpm | awk '{print $1}')"
test -n "$EXPECTED_SHA256" && test "$EXPECTED_SHA256" != "null" && test "$ACTUAL_SHA256" = "$EXPECTED_SHA256"
sudo rpm -i kt-linux-x86_64.rpm

Linux (ARM64)

RELEASE_BASE="https://dl.eu.keeptrusts.com/releases/latest" # or https://dl.us.keeptrusts.com/releases/latest
curl -fsSLO "${RELEASE_BASE}/kt-linux-aarch64.tar.gz"
EXPECTED_SHA256="$(curl -fsSL "${RELEASE_BASE}/manifest.json" | jq -r '.artifacts[] | select(.filename == "kt-linux-aarch64.tar.gz") | .sha256')"
ACTUAL_SHA256="$(sha256sum kt-linux-aarch64.tar.gz | awk '{print $1}')"
test -n "$EXPECTED_SHA256" && test "$EXPECTED_SHA256" != "null" && test "$ACTUAL_SHA256" = "$EXPECTED_SHA256"
sudo tar xzf kt-linux-aarch64.tar.gz -C /usr/local/bin kt
rm kt-linux-aarch64.tar.gz

Windows

$releaseBase = "https://dl.eu.keeptrusts.com/releases/latest" # or https://dl.us.keeptrusts.com/releases/latest
Invoke-WebRequest -Uri "$releaseBase/kt-windows-x86_64.zip" -OutFile kt-windows-x86_64.zip
$manifest = Invoke-RestMethod -Uri "$releaseBase/manifest.json"
$expected = ($manifest.artifacts | Where-Object filename -eq "kt-windows-x86_64.zip").sha256
$actual = (Get-FileHash kt-windows-x86_64.zip -Algorithm SHA256).Hash.ToLower()
if (-not $expected -or $actual -ne $expected) { throw "Keeptrusts archive checksum mismatch" }
Expand-Archive kt-windows-x86_64.zip -DestinationPath "$env:LOCALAPPDATA\keeptrusts"
$env:PATH += ";$env:LOCALAPPDATA\keeptrusts"

Docker

docker pull keeptrusts/kt:latest
docker run --rm keeptrusts/kt:latest --version

The container image contains the same kt command. Follow the Quickstart and mount its policy-config.yaml when you are ready to run the gateway; starting an unconfigured container is not a governed deployment.

The shell checksum examples require jq; install it before using the direct download path. A missing manifest entry, empty expected hash, or mismatch must stop the install. The regional installer performs its own binary checksum check and is the simpler verified path.

Verify the install

kt --version
kt doctor

kt doctor should confirm the binary runs and call out any missing prerequisites before you continue.

Create a starter project

kt init

This scaffolds a starter policy-config.yaml and sample tests so you can move directly into Quickstart.

Next steps

1. Follow Quickstart to create a minimal governed config and send a first request.
2. Read Config-First Workflow if you want the recommended operating model before rollout.
3. Use CLI Installation when you need the full CLI-specific install matrix and release-host details.