---
title: "Installation"
description: "Install Orbit on macOS, Linux and CI runners, plus authentication and upgrades."
canonical: "https://orbit-handbook.sitesmojo.com/docs/installation/"
---

# Installation

Orbit is a single static binary. No daemon, no agent, nothing to babysit.

## macOS and Linux

```bash
curl -fsSL https://get.orbit.example/install.sh | sh
```

Or with Homebrew:

```bash
brew install orbit-cli
```

## Verify

```bash
orbit version
orbit doctor
```

`orbit doctor` checks your container runtime, credentials, and network path to
the registry, and prints a fix for anything it finds.

## CI runners

Pin the version in CI - never install `latest` on a runner:

```yaml
# GitHub Actions
- uses: orbit-example/setup-orbit@v1
  with:
    version: 0.4.2
- run: orbit deploy --env staging --yes
```

`--yes` skips the interactive confirmation; the plan and diff still go to the
job log, so the record of what changed survives in CI output.

## Authentication

| Context | Method |
|---------|--------|
| Laptop  | `orbit login` (device flow, short-lived token) |
| CI      | `ORBIT_TOKEN` environment variable, scoped to one project |

Tokens are scoped and expiring; a leaked CI token cannot touch environments
outside its project.

## Upgrading

```bash
orbit self-update
```

Patch releases never change plan output. Anything that alters what a plan
means gets a minor version and a note in [Field Notes](/blog/).