​
macOS and Linux

Download and run the install script: 
curl -fsSL https://raw.githubusercontent.com/randyphoa/wxctl/main/install.sh | sh
It downloads the latest release binary for your platform (macOS and Linux, x86_64 and arm64), verifies its SHA-256 checksum, and installs it to ~/.local/bin. Override the version or install directory with WXCTL_VERSION and WXCTL_INSTALL_DIR: 
curl -fsSL https://raw.githubusercontent.com/randyphoa/wxctl/main/install.sh | WXCTL_VERSION=v0.1.0 sh
curl -fsSL https://raw.githubusercontent.com/randyphoa/wxctl/main/install.sh | WXCTL_INSTALL_DIR=/usr/local/bin sh
If ~/.local/bin is not on your PATH, add it: 
export PATH="$HOME/.local/bin:$PATH"

​
Windows

Run the install script in PowerShell: 
irm https://raw.githubusercontent.com/randyphoa/wxctl/main/install.ps1 | iex
It downloads the latest release binary for your architecture (x86_64 and arm64), verifies its SHA-256 checksum, installs it to %LOCALAPPDATA%\wxctl\bin, and removes the “Mark of the Web” so Windows does not block it. Override the version or install directory with WXCTL_VERSION and WXCTL_INSTALL_DIR: 
$env:WXCTL_VERSION = 'v0.1.0'; irm https://raw.githubusercontent.com/randyphoa/wxctl/main/install.ps1 | iex
$env:WXCTL_INSTALL_DIR = 'C:\tools\wxctl'; irm https://raw.githubusercontent.com/randyphoa/wxctl/main/install.ps1 | iex
If the install directory is not on your PATH, the script prints a command to add it for the current user. Open a new terminal afterward. Under WSL, follow the macOS and Linux steps.

​
npm

Install globally with npm as an alternative to the install script. It works the same on macOS, Linux, and Windows, and skips the macOS Gatekeeper and Windows SmartScreen prompts: 
npm install -g wxctl
npm install downloads a prebuilt binary for your platform (there is no Node.js runtime dependency and no compile step) and puts wxctl on your PATH. Binaries delivered through npm carry no macOS Gatekeeper quarantine or Windows “Mark of the Web”, so this avoids the “unidentified developer” and SmartScreen prompts you can hit with a hand-downloaded binary. npm delivers binaries for glibc Linux, macOS, and Windows. Alpine and other musl-based Linux are not supported over npm: npm install -g wxctl fails with a clear “no musl build” message. Use the install script or build from source on musl. Run a one-off command without a global install: 
npx wxctl --help
The first npx wxctl downloads the prebuilt binary for your platform, a one-time step. For repeated use, install it globally with npm install -g wxctl. Upgrade with npm update -g wxctl, not wxctl update (see Upgrade).

​
Download a binary

Every release includes a per-platform archive and a SHA256SUMS file. Download the archive for your platform, verify it, extract it, and move wxctl onto your PATH.
PlatformArchive
macOS, Apple Silicon (arm64)wxctl-<version>-aarch64-apple-darwin.tar.gz
macOS, Intel (x86_64)wxctl-<version>-x86_64-apple-darwin.tar.gz
Linux, x86_64wxctl-<version>-x86_64-unknown-linux-gnu.tar.gz
Linux, arm64wxctl-<version>-aarch64-unknown-linux-gnu.tar.gz
Windows, x86_64wxctl-<version>-x86_64-pc-windows-msvc.zip
Windows, arm64wxctl-<version>-aarch64-pc-windows-msvc.zip
Each archive extracts to a folder containing the wxctl binary (wxctl.exe on Windows), LICENSE, and README.md. A hand-downloaded macOS binary is quarantined by Gatekeeper; clear it with xattr -d com.apple.quarantine ./wxctl, or install with npm to skip the prompt entirely.

​
Build from source

Requires Rust 1.88 or newer. 
rustc --version   # 1.88.0 or newer
git clone https://github.com/randyphoa/wxctl.git
cd wxctl
cargo build --release
cp target/release/wxctl ~/.local/bin/   # or add target/release to PATH
Confirm the install: 
wxctl --help

​
Configure a profile

wxctl init scaffolds a commented ~/.wxctl/profiles.yaml with a service block for every service (or just the ones a config uses), written with 0600 permissions. It does no prompting: you fill in the credentials afterward. 
wxctl init                            # scaffold every service
wxctl init -f config.yaml             # scaffold only the services your config needs
wxctl init -f config.yaml -p staging  # scaffold a named profile
wxctl init --edit                     # scaffold, open $EDITOR, then validate
Each service block carries a format-hint URL, an auth_type, and for every credential field both a commented ${env:...} line and a PASTE_YOUR_<FIELD>_HERE placeholder. Fill each placeholder with a real value or uncomment the ${env:...} line, then run wxctl profile validate.

​
Authentication types

wxctl init scaffolds each service’s auth_type into ~/.wxctl/profiles.yaml. See Profiles & credentials for the supported auth types (apikey, zenapikey, cp4d, hmac, and more) and the fields each one needs.

​
Active profile

Commands that talk to remote services (plan, apply, destroy, test) use the active profile. It is resolved in this order:
  1. The -p, --profile <name> flag
  2. The WXCTL_PROFILE environment variable
  3. ~/.wxctl/active_profile
  4. default

​
Upgrade

If you installed with npm, upgrade with npm. wxctl update detects an npm install and points you here rather than replacing a binary inside node_modules: 
npm update -g wxctl
Otherwise, update in place to the latest release: 
wxctl update           # prompt, then download, verify, and self-replace
wxctl update --yes     # skip the confirmation prompt
wxctl update --notes   # show release notes for newer versions without installing
Or re-run the install script. If you built from source, pull the latest source and rebuild: 
cd wxctl
git pull
cargo build --release
cp target/release/wxctl ~/.local/bin/
Confirm the new version with wxctl --version. See Releases for what changed.

​
Uninstall

Remove the binary and wxctl’s local data. If you installed with npm, remove it with npm uninstall -g wxctl instead of deleting the binary by hand: 
npm uninstall -g wxctl  # if installed with npm
rm ~/.local/bin/wxctl   # if installed with the script or by hand
rm -rf ~/.wxctl         # remove profiles, credentials, and run records
~/.wxctl/ holds profiles.yaml (your profiles), active_profile, and the runs/ history. Deleting it removes all stored credentials.

​
Next steps

Quickstart

Declare resources and run your first plan.