# Getting started

URL: https://shellz.dev/docs/getting-started

> Sign up, install shellz on a Linux server with one command, and watch your first session live.

This guide takes you from a new account to watching a live session in about two minutes. You need a Linux server with systemd where you can run `sudo`. For containers on Kubernetes, ECS or similar platforms, see [Choose an install method](https://shellz.dev/docs/install.md).

## 1. Create your account

Go to [app.shellz.dev/signup](https://app.shellz.dev/signup) and sign up with Google, GitHub or a passkey.

- **Google or GitHub**: you're signed in straight away. You'll be offered a passkey afterwards; it's optional until you turn on Perfect Secrecy.
- **Passkey**: enter your email address, open the link shellz sends you (it works once and expires after 15 minutes), then create the passkey on that device.

shellz tests every passkey before accepting it. It must be discoverable, require user verification (a fingerprint, face or PIN) and support the WebAuthn PRF extension, which [Perfect Secrecy](https://shellz.dev/docs/security/perfect-secrecy.md) uses to derive encryption keys. If yours fails, shellz says why and lists authenticators known to work: iCloud Keychain, Google Password Manager, 1Password and YubiKey 5 (firmware 5.7 or later).

Your org (your team's shared workspace) is created automatically. Owners and admins can rename it from the onboarding screen.

## 2. Install shellz on your server

The onboarding screen, **Record your first session**, shows an install command with a fresh join token already filled in. Copy it and run it on your server:

```bash title="On your server"
curl -fsSL https://get.shellz.dev | sudo sh -s -- szt_<your join token>
```

The token works once and expires after 10 minutes. To add more servers later, open **~/servers** and click **Add server** for a new command.

The installer:

1. Checks that it's running as root on a systemd Linux server (amd64 or arm64) with curl and OpenSSL 3, and that the token isn't damaged.
2. Downloads the shellz binary for your architecture and verifies its Ed25519 release signature and SHA-256 checksum against the key built into the script.
3. Enrolls the server: it creates the server's own signing key, redeems the token and pins your org's public key.
4. Starts the recorder and routes every login on the server through it.

```text title="Output"
  → Fetching the latest release for linux/amd64
  ✓ Release 0.1.2 signature verified
  → Downloading shellz 0.1.2
  ✓ Checksum verified
  ...
  This server is now recording. Watch sessions live at https://app.shellz.dev
```

> [!TIP]
> On Rocky, Alma and RHEL, sudo's `secure_path` doesn't include `/usr/local/bin`, so call shellz by its full path: `sudo /usr/local/bin/shellz status`.

Installing somewhere else? See [Linux server](https://shellz.dev/docs/install/linux.md) for supported distributions and exactly what the installer changes, and [Docker host](https://shellz.dev/docs/install/docker-host.md) if the server runs Docker.

## 3. Watch your first session

As soon as the server connects, the onboarding screen switches to **Your server is recording**. Open a terminal and SSH into the server as you normally would. The session appears in the dashboard about a second behind what you type.

Before showing any recording, shellz asks you to confirm it's you if your last sign-in was more than 10 minutes ago. The recording is then decrypted in your browser, and the view is written to the audit log.

In the player you can:

- follow the session live, or replay it at 0.5×, 1×, 2× or 4× speed;
- switch between the terminal replay and the text transcript, and click a transcript line to jump to it;
- download the session as `.cast` (replay) or `.txt` (transcript);
- check the integrity badge: **verified** means every piece is signed and chained, **gap** means a piece is missing, and **tampered** means a signature or the chain failed.

## 4. Check the server

On the server, `shellz status` shows the enrollment, policy and recorder state:

```bash
sudo /usr/local/bin/shellz status
```

```text title="Output"
shellz 0.1.2

  Server     prod-api-01 (6f1c…)
  Org key    3b9e…, standard mode
  Policy     revision 1, recording on
  Recorder   running, pid 812, version 0.1.2
  Sessions   1 active
             ssh alice since 2026-11-04 10:12:03
  Upload     up to date
```

## Next steps

- Invite teammates from **~/team**. See [Team and access](https://shellz.dev/docs/guides/team.md).
- Choose where alerts go: email, Slack or a webhook. See [Alerts](https://shellz.dev/docs/guides/alerts.md).
- Decide what happens when recording can't keep up. See [Recording policy](https://shellz.dev/docs/guides/recording-policy.md).
- Turn on [Perfect Secrecy](https://shellz.dev/docs/security/perfect-secrecy.md) so only your team can decrypt recordings.