Getting started

This guide takes you from a new account to watching a live session in about two minutes. You need a Linux server with systemd where you can run sudo. For containers on Kubernetes, ECS or similar platforms, see Choose an install method.

1. Create your accountCopy Anchor Link

Go to app.shellz.dev/signup and sign up with Google, GitHub or a passkey.

• Google or GitHub: you're signed in straight away. You'll be offered a passkey afterwards; it's optional until you turn on Perfect Secrecy.
• Passkey: enter your email address, open the link shellz sends you (it works once and expires after 15 minutes), then create the passkey on that device.

shellz tests every passkey before accepting it. It must be discoverable, require user verification (a fingerprint, face or PIN) and support the WebAuthn PRF extension, which Perfect Secrecy uses to derive encryption keys. If yours fails, shellz says why and lists authenticators known to work: iCloud Keychain, Google Password Manager, 1Password and YubiKey 5 (firmware 5.7 or later).

Your org (your team's shared workspace) is created automatically. Owners and admins can rename it from the onboarding screen.

2. Install shellz on your serverCopy Anchor Link

The onboarding screen, Record your first session, shows an install command with a fresh join token already filled in. Copy it and run it on your server:

curl -fsSL https://get.shellz.dev | sudo sh -s -- szt_<your join token>

The token works once and expires after 10 minutes. To add more servers later, open ~/servers and click Add server for a new command.

The installer:

1. Checks that it's running as root on a systemd Linux server (amd64 or arm64) with curl and OpenSSL 3, and that the token isn't damaged.
2. Downloads the shellz binary for your architecture and verifies its Ed25519 release signature and SHA-256 checksum against the key built into the script.
3. Enrolls the server: it creates the server's own signing key, redeems the token and pins your org's public key.
4. Starts the recorder and routes every login on the server through it.

  → Fetching the latest release for linux/amd64
  ✓ Release 0.1.2 signature verified
  → Downloading shellz 0.1.2
  ✓ Checksum verified
  ...
  This server is now recording. Watch sessions live at https://app.shellz.dev

Installing somewhere else? See Linux server for supported distributions and exactly what the installer changes, and Docker host if the server runs Docker.

3. Watch your first sessionCopy Anchor Link

As soon as the server connects, the onboarding screen switches to Your server is recording. Open a terminal and SSH into the server as you normally would. The session appears in the dashboard about a second behind what you type.

Before showing any recording, shellz asks you to confirm it's you if your last sign-in was more than 10 minutes ago. The recording is then decrypted in your browser, and the view is written to the audit log.

In the player you can:

• follow the session live, or replay it at 0.5×, 1×, 2× or 4× speed;
• switch between the terminal replay and the text transcript, and click a transcript line to jump to it;
• download the session as .cast (replay) or .txt (transcript);
• check the integrity badge: verified means every piece is signed and chained, gap means a piece is missing, and tampered means a signature or the chain failed.

4. Check the serverCopy Anchor Link

On the server, shellz status shows the enrollment, policy and recorder state:

sudo /usr/local/bin/shellz status

shellz 0.1.2

  Server     prod-api-01 (6f1c…)
  Org key    3b9e…, standard mode
  Policy     revision 1, recording on
  Recorder   running, pid 812, version 0.1.2
  Sessions   1 active
             ssh alice since 2026-11-04 10:12:03
  Upload     up to date

Next stepsCopy Anchor Link

• Invite teammates from ~/team. See Team and access.
• Choose where alerts go: email, Slack or a webhook. See Alerts.
• Decide what happens when recording can't keep up. See Recording policy.
• Turn on Perfect Secrecy so only your team can decrypt recordings.