> For the complete documentation index, see [llms.txt](https://docs.devolutions.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.devolutions.net/cli/guides/understand/platforms.md).

# Devolutions CLI on Windows, macOS, and Linux

What changes in Devolutions CLI between Windows, macOS, and Linux: sign-in, file protection, folders, and the background process.

Devolutions CLI has the **same commands, options, and references on every platform**. A script that runs `devo secret run` on a Windows laptop runs the same way on a Linux build agent. What changes is how Devolutions CLI uses each operating system: how it protects the files it writes, where it keeps sign-in sessions, and how its background process talks to `devo`.

## What's different on each platform

<table><thead><tr><th width="190">TOPIC</th><th>WINDOWS</th><th>MACOS</th><th>LINUX</th></tr></thead><tbody><tr><td><strong>Command file</strong></td><td><code>devo.exe</code></td><td><code>devo</code></td><td><code>devo</code></td></tr><tr><td><strong>Architectures</strong></td><td>x64, Arm64</td><td>x64, Arm64</td><td>x64, Arm64</td></tr><tr><td><strong>Windows authentication</strong> (<code>devo login --windows-auth</code>)</td><td>Available, with Devolutions Server.</td><td>Not available: <code>devo login</code> stops with <code>invalidParameterValue</code>.</td><td>Not available: <code>devo login</code> stops with <code>invalidParameterValue</code>.</td></tr><tr><td><strong>Browser sign-in sessions</strong> (<code>--oauth</code>)</td><td>Encrypted with your Windows user account, in files of the Devolutions CLI configuration folder.</td><td>In the Keychain.</td><td>In the Secret Service, through the <code>libsecret</code> library. Without that library, browser sign-in stops with <code>cloudOAuthSecureStoreRequired</code> or <code>serverOAuthSecureStoreRequired</code>. If the library can't store the session, it stops with <code>cloudOAuthStorageFailed</code> or <code>serverOAuthStorageFailed</code>.</td></tr><tr><td><strong>Files that hold a secret</strong> (<code>--out-file</code> of <code>devo secret read</code>, <code>get</code>, and <code>inject</code>)</td><td>Access rules that allow only your account, the Administrators group, and the system account.</td><td>Readable and writable by your account only.</td><td>Readable and writable by your account only.</td></tr><tr><td><strong>Private key from <code>devo generate ssh-key</code></strong></td><td>Devolutions CLI doesn't change the file's permissions.</td><td>Readable and writable by your account only.</td><td>Readable and writable by your account only.</td></tr><tr><td><strong>Configuration folder protection</strong> (contexts, sign-in session files, telemetry preference)</td><td>When Devolutions CLI records its background process, it gives the folder access rules that allow only your account and the system account. Files created in the folder inherit them.</td><td>When Devolutions CLI records its background process, the folder becomes accessible to your account only. Context files and the telemetry preference are also readable and writable by your account only.</td><td>When Devolutions CLI records its background process, the folder becomes accessible to your account only. Context files and the telemetry preference are also readable and writable by your account only.</td></tr><tr><td><strong><code>devo config export</code> file</strong></td><td>Devolutions CLI doesn't change the file's permissions.</td><td>Readable and writable by your account only.</td><td>Readable and writable by your account only.</td></tr><tr><td><strong>Background process: local channel</strong></td><td>A named pipe with access rules for your account and the system account. If Windows refuses those rules, the pipe uses default security.</td><td>A socket file in the temporary folder, readable and writable by your account only.</td><td>A socket file in the temporary folder, readable and writable by your account only.</td></tr><tr><td><strong>Background process: its own files</strong> (registration and locks)</td><td>Access rules that allow only your account and the system account.</td><td>Your account only.</td><td>Your account only.</td></tr><tr><td><strong>Background process: how it starts</strong></td><td>As a hidden process, without a window.</td><td>Through <code>/bin/sh</code>, with its input and output disconnected from your terminal.</td><td>Through <code>/bin/sh</code>, with its input and output disconnected from your terminal.</td></tr><tr><td><strong>Configuration folder location</strong></td><td colspan="3"><code>Devolutions/CLI</code> in your user's local application data folder, or <code>.devolutions/cli</code> in your home folder if there's no local application data folder. <code>DEVO_CLI_CONFIG_HOME</code> replaces it on every platform.</td></tr><tr><td><strong>Folder paths</strong> (configuration and profile folders)</td><td>Devolutions CLI compares them without case.</td><td>Devolutions CLI compares them with case.</td><td>Devolutions CLI compares them with case.</td></tr><tr><td><strong>SecretSpec claim, for your user</strong></td><td><code>SecretSpec\providers.d</code> in your roaming application data folder</td><td><code>~/Library/Application Support/SecretSpec/providers.d</code></td><td><code>$XDG_CONFIG_HOME/secretspec/providers.d</code>, or <code>~/.config/secretspec/providers.d</code> when <code>XDG_CONFIG_HOME</code> isn't set or isn't an absolute path</td></tr><tr><td><strong>SecretSpec claim, with <code>--system</code></strong></td><td><code>SecretSpec\providers.d</code> in the machine-wide application data folder</td><td><code>/Library/Application Support/SecretSpec/providers.d</code></td><td><code>/etc/secretspec/providers.d</code></td></tr></tbody></table>

## The same on every platform

* **Shells for `devo secret shell`.** `--shell bash` and `--shell pwsh` (or `powershell`) work on Windows, macOS, and Linux. Pick the shell you run the script in, not the operating system. See [Use secrets in your current shell](/cli/guides/secrets/current-shell.md).
* **Browser sign-in.** `devo login --oauth` asks the operating system to open the address in a browser, and always prints the address too. If no browser opens, copy the address. On a computer without a browser, add `--use-device-code` with Devolutions Server, or sign in with an application key to Devolutions Cloud. See [Sign in to Devolutions Cloud](/cli/guides/connect/devolutions-cloud.md).
* **Environment variables.** Every variable works the same way on every platform. See [Environment variables](/cli/reference/environment-variables.md).

## What this means for you

**Windows authentication needs Windows.** On macOS and Linux, sign in to Devolutions Server with a browser, an API key, or a username and password instead. A context created with `--windows-auth` doesn't work on another platform, even if you share the configuration folder: commands stop with `windowsAuthenticationUnsupported`. See [Sign in to Devolutions Server](/cli/guides/connect/devolutions-server.md).

**On Linux, browser sign-in needs the Secret Service.** Devolutions CLI never writes a browser sign-in session to a plain file. When the Secret Service isn't available, for example on some build agents, sign in with an application secret or an API key instead. See [Sign in from a CI pipeline](/cli/for-devops-and-administrators/automate/ci-sign-in.md).

**Files with a secret are private, but still plain text.** Devolutions CLI restricts who can open what it writes with `--out-file`, on every platform. On Windows, members of the Administrators group can still open it. The value inside is in plain text: delete the file when you're done. See [What stays hidden, and what doesn't](/cli/guides/understand/security-model.md).

**On Windows, protect your SSH private keys yourself.** `devo generate ssh-key` doesn't restrict the private key file on Windows. Write it to a folder only you can open, not to a shared folder. See [Generate passwords and SSH keys](/cli/guides/generate.md).

**On macOS and Linux, folder names must match exactly.** Devolutions CLI treats two spellings such as `Profiles` and `profiles` as two different folders, each with its own background process. Use the same spelling in `RDM_CONFIG_PATH`, `DEVO_CLI_CONFIG_HOME`, and `--sqlite` everywhere.

**On macOS and Linux, the background process needs a short temporary folder path.** Its socket file lives in the temporary folder. If that path is very long, Devolutions CLI can't create the socket and the background process doesn't start. See [The background process won't start](/cli/help/troubleshooting/daemon-wont-start.md).

## Next

* [Install Devolutions CLI](/cli/reference/installation.md)
* [What data Devolutions CLI sends](/cli/guides/understand/privacy.md)
* [Use Devolutions CLI with SecretSpec](/cli/guides/secrets/secretspec.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.devolutions.net/cli/guides/understand/platforms.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.