Choose the installation workflow that fits your environment.
[Before installing the CLI, complete the prerequisites.](..#prerequisites)
## Install through a package manager
Using a package manager is the recommended method for installing the Cortex CLI. Use `Homebrew` for macOS and Linux, or `Scoop` for Windows.
### Homebrew for macOS and Linux
Supported on macOS, Apple Silicon and Intel, and Linux, x86\_64 and arm64.
Requires [Homebrew](https://brew.sh/).
#### Standard installation
```programlisting
brew tap paloaltonetworks/cortexcli
brew install cortexcli
cortexcli --version
```
#### Pin a specific version (optional)
If your workflow requires a specific version, use one of these methods.
**Pin a release line**
For example, stay on the `0.18.x` release line.
This locks the CLI to a minor version. Security patches continue automatically.
```programlisting
brew install cortexcli@0.18
# keg-only — add to PATH if needed:
echo 'export PATH="$(brew --prefix cortexcli@0.18)/bin:$PATH"' >> ~/.zprofile
```
**Pin an exact version**
For example, install exactly `0.18.0`.
This locks the CLI to one build. It prevents automatic updates.
### Scoop for Windows
Supported on Windows x64.
Requires [Scoop](https://scoop.sh/).
#### Standard installation
```programlisting
scoop bucket add cortexcli https://github.com/PaloAltoNetworks/homebrew-cortexcli
scoop install cortexcli
cortexcli --version
```
#### Install a specific version (optional)
If your workflow requires a specific version, use:
```programlisting
scoop install cortexcli@0.18.0
```
## Manual download
You can manually download the binaries for macOS, Linux, or Windows.
Download the archive from the [releases page](https://github.com/PaloAltoNetworks/homebrew-cortexcli/releases). Verify it against `SHA256SUMS`, then extract it.
| Step | macOS / Linux | Windows |
| ----------------- | --------------------------------------------------------- | ---------------------------------------------------------------------------------------- |
| **Download** | Download the `.tar.gz` archive for your architecture | Download the `.zip` archive |
| **Extract** | The executable is named `cortexcli` | The executable is named `cortexcli.exe` |
| **Add to `PATH`** | Move `cortexcli` to a directory such as `/usr/local/bin/` | Move `cortexcli.exe` to a dedicated folder. Add that folder to **Environment Variables** |
## UI-based installation
Install the CLI directly from your Cortex tenant. The UI generates a tenant-specific command that downloads and authenticates the binary.
### Generate the installation command
1. Navigate to **Settings** → **Data Sources** → **+ Data Source**.
2. Search for **Cortex CLI**.
3. Select **Connect** or **Connect Another Instance** on the Cortex CLI card.
4. In **Configure**, select your operating system. Then click **Next**.
5. In **Authenticate**, generate an API key.
* Select **With upload results permissions** to create a **CLI View/Edit** role.
* Otherwise, the key receives a **CLI Read Only** role with **CLI View** permissions.
The Cortex CLI requires an API key with the `Standard` security level.
6. Save the generated **API Key ID** and **API key**.
7. Copy the command from **Retrieve your API key**.
On macOS ARM64, unpack the download to access the executable.
8. Verify the key appears in the API Keys inventory.
### Download the CLI
Before you run the command, replace any placeholders with your credentials:
1. Replace `${API_KEY}` with the saved API key.
2. If needed, copy the API URL from **Settings** → **Configurations** → **API Keys**.
3. Paste the completed command into your terminal. Then press Enter.
The generated command follows this syntax:
```programlisting
curl -k -u $CORTEX_API_ID::$CORTEX_API_KEY --output ./cortexcli $CORTEX_FQDN/api/v2/remote-li/{version}/{platform}/artifacts
```
This securely connects to your specific Cortex tenant (`$CORTEX_FQDN`) and downloads the `cortexcli` application directly to your current folder.
### Make the CLI executable
On macOS and Linux, allow the downloaded binary to run:
```programlisting
chmod +x cortexcli
```
### Verify the installation
Run the command that matches the binary location:
```programlisting
cortexcli -v
```
```programlisting
./cortexcli -v
```
If the terminal displays a version, return to Cortex Cloud and click **Done**.
Configure credentials before running scans. See [Authenticate credentials](authenticate-credentials).