Getting started

Setup takes about ten minutes and you do it once, yourself. Your agent can do everything after that.

You need: a laptop with Node.js 22.18 or later, npm, openssl and ssh, plus two things from your admin:

an invite to the private network, sent to the email you gave them;
a setup message with the link to download af, its sha256 checksum and a one-time login token.

Join the private network.

Accept the invite with the email your admin used, and install Tailscale on your laptop. Sign in with the same email.

On Linux, also accept the routes to your Lane. macOS, Windows, iOS and Android do this by default.
Terminal window
```
sudo tailscale set --accept-routes
```
Install af.

Use the link and checksum from your setup message. The link works only once you are on the private network.
Terminal window
```
curl -fO "<link from your setup message>"
echo "<sha256 from your setup message>  af-<version>.tgz" | shasum -a 256 -c
npm install -g ./af-<version>.tgz
```
If the checksum does not match, stop and tell your admin. Do not install it.

To update later, do the same with the new link your admin sends. A copy of this guide is installed with af, at "$(npm root -g)/@sq/atominfra/af.md".
Log in.
Terminal window
```
af login
```
Paste the one-time token when it asks. It goes in on stdin, never as an argument. af stores your client certificate in ~/.config/af/, readable only by you. Keep the token private: anyone with it can log in to your Lane until you use it.
Add your SSH key.
Terminal window
```
af keys add ~/.ssh/id_ed25519.pub
```
No key yet? ssh-keygen -t ed25519 makes one. The .pub file is the public half that you add here; the other file never leaves your laptop. You do not need a GitHub account.
Check everything works.
Terminal window
```
af whoami --json    # your Lane and its limits
af doctor --json    # every check should be "ok"
```
A lane-network failure in af doctor almost always means step 1’s routes are not accepted on this device.

Your first Box

af box create dev --size S --json   # waits until SSH answers
af box ssh dev

You are in. Next, read Boxes, or hand af to your coding agent: Using af with your coding agent.