Install on macOS

The same script that installs the CLI on a Linux server installs it on a Mac, Apple silicon or Intel, as /usr/local/bin/sxaccess. It registers the agent as a LaunchDaemon and starts it, so launchd runs the agent from boot, whether or not anyone is logged in. The script needs root rights and asks for your password through sudo, so run it on its own and wait until it has finished. Running it again replaces the installed version in place, which is how you upgrade; the installer options are the same as on Linux.

Then connect the Mac: sxaccess start opens your browser so you can sign in. A Mac nobody signs in at enrols with a key instead, see A Mac with nobody at it. For a Mac someone works at every day, the SXAccess app is the simpler choice.

launchd runs the agent, so the systemctl commands you may know from Linux do not apply. The agent commands manage it instead; they need sudo, except agent info, which prints Agent service: Running while the agent runs.

sxaccess start and sxaccess stop connect and disconnect the Mac without touching the service.

There is no browser to open on a Mac nobody signs in at, so enrol it with an enrollment key. A device enrolled with a key has no owner and its session never expires. Pass the key with --enrollment-key for a one-off, or point --enrollment-key-file at a file when the key comes from a secret store: the file keeps the key out of ps and out of your shell history. The sxaccess command reads the file itself, so keep it readable by the account that runs the command and by nobody else. SX_ENROLLMENT_KEY works as well, as on Linux.

A Mac's identity is its private key, kept in /var/lib/sxaccess/default.json. Reset when that identity should not be reused: a Mac handed to someone else, a Mac moving to another organization for good, or state that a fresh sxaccess start no longer repairs. An expired session does not need this; sxaccess start renews it.

The steps are the same as on Linux, and the Mac comes back as a new device, with a new key and a new overlay address. First disconnect, undo the DNS and route changes the agent recorded, and stop the agent:

Now delete the Mac under Devices in the dashboard. That revokes the old key, and it frees the Mac's DNS name: while the old entry exists, a new device gets that name with two numbers added.

Then delete the agent's state, which the agent creates again when it starts, and ~/Library/Application Support/sxaccess, which records which identity the CLI uses. Start the agent and sign in again. On a Mac nobody signs in at, end with sxaccess start --enrollment-key-file <file> instead, as in A Mac with nobody at it.

Unlike Linux, macOS has a single command for it. sudo sxaccess uninstall stops the agent and removes the LaunchDaemon, the socket and the binary. It deletes the logs and the settings, and resets /var/lib/sxaccess to this Mac's identity alone: its keys and the organization it enrolled in. Install again and sign in, and the Mac comes back as the same device instead of a new one.

Add --purge to remove the identity as well, so that the next sign-in adds a new device. Use it when the Mac leaves your organization for good, and delete the device under Devices in the dashboard, which revokes its key. --keep-data keeps everything instead: settings, logs and identity, as an upgrade would.