> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tensor9.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Install and Authenticate

> Obtain a Tensor9 API key, verify your identity and understand Cloud Adapter licenses.

<Note>
  Tensor9 offers custom service-level agreements (SLAs). The SLA in your contract supersedes the default service levels and operational terms described in this guide.
</Note>

Cloud Adapter requires a Tensor9 customer account. Your `T9_API_KEY` identifies that account when you acquire adapter artifacts, obtain or renew a license, and use online services such as Explain. Installing the CLI does not grant access to every adapter.

## Install the CLI

Install with Homebrew, using the same distribution as Tensor9 BYOC:

```bash theme={null}
brew tap tensor9ine/tensor9
brew install tensor9
tensor9 --version
```

If the CLI is already installed, use `brew upgrade tensor9` instead of `brew install tensor9`.

Alternatively, use the install script on a supported macOS or Linux system:

```bash theme={null}
curl -sSL https://t9-artifacts-prod-1.s3.us-west-2.amazonaws.com/install-latest.sh | sh
tensor9 --version
```

## Set your API key and verify your identity

A Tensor9 API key is required. Use the key issued during onboarding, or email [hello@tensor9.com](mailto:hello@tensor9.com) to request one for your organization. Do not share your account or key with another customer or organization.

If your secret manager has already supplied `T9_API_KEY`, skip the prompt. Otherwise, enter your key at a hidden prompt in the terminal where you will run `tensor9`:

<Tabs>
  <Tab title="Bash">
    ```bash theme={null}
    set +x
    IFS= read -r -s -p 'Tensor9 API key: ' T9_API_KEY
    printf '\n'
    export T9_API_KEY
    ```
  </Tab>

  <Tab title="Zsh">
    ```zsh theme={null}
    set +x
    IFS= read -r -s 'T9_API_KEY?Tensor9 API key: '
    printf '\n'
    export T9_API_KEY
    ```
  </Tab>
</Tabs>

Check that the variable is set without printing it, then verify your Tensor9 identity:

```bash theme={null}
: "${T9_API_KEY:?Set T9_API_KEY before continuing}"
tensor9 whoami
```

Confirm that the reported identity belongs to the intended customer account. Do not continue if authentication fails or the account is wrong. Keep shell tracing disabled while using the key. Do not paste the key into commands, shell profiles, source files, screenshots or support messages.

The exported variable applies to this terminal and its child processes. In another terminal, supply it again through your secret manager or the hidden prompt. For CI/CD, inject `T9_API_KEY` from the CI provider's secret store into the operator job. Do not put its value in workflow YAML, container images, adapter configuration or command-line arguments.

## Understand your adapter access

An entitlement grants a specific direction, such as S3 requests served by Google Cloud Storage. It does not also grant the reverse direction or every backend for S3. An adapter must both exist in your installed release and be allowed by your license.

Tensor9 distributes one standard signed binary per release and platform, containing all adapters shipped in that release. A separately signed customer license determines which adapters the binary accepts during configuration, startup and request handling. Customers do not need a custom build when entitlements change.

The service catalog, tuning guides, trade-off analyses and service-level terms are public, including detailed compatibility for each documented direction. Online Explain and use of the licensed binary remain authenticated and entitlement-scoped. Read the public profile to assess fit, then use Explain to inspect the direction your account can run.

The public service catalog gives you exact origin identifiers and describes backend choices. After authentication, use `tensor9 adapt svc list -origin ORIGIN -fmt Human` to discover the exact target identifiers your account is entitled to run for that origin, then use one returned target with Explain. The CLI discovery result does not enumerate other origins or grant access to an unlicensed adapter.

## Keep credentials separate

| Credential               | Where it belongs                                                  | What it permits                                                                     |
| ------------------------ | ----------------------------------------------------------------- | ----------------------------------------------------------------------------------- |
| `T9_API_KEY`             | The operator's CLI environment or CI secret store                 | Authenticated Tensor9 acquisition, license issuance or renewal, and online services |
| Signed customer license  | The deployed adapter's protected license material                 | Local use of the directed adapters granted to the customer account                  |
| Application credentials  | The application's origin API client                               | Requests to the adapter endpoint under its configured authentication model          |
| Target-cloud credentials | The adapter's backend identity or standard cloud credential chain | Operations on resources in the target cloud                                         |

Neither the binary nor the license contains your raw API key. Do not send `T9_API_KEY` in application requests or use it as a cloud credential. Protect the license as sensitive deployment material. Replicas within the licensed account may use the same license; sharing an account, API key or license with another customer or organization is prohibited.

## Plan license renewal

A license has a one-calendar-year term. Begin renewal 30 days before the term ends. It includes another 30 days of signed grace after the term ends, giving your deployment time to receive the replacement license.

Schedule an authenticated operator job to renew the license and distribute it to replicas. The adapter checks the replacement before installing it atomically; a failed replacement leaves the existing valid license in place. Monitor renewal status and final expiry, not just process health. Early renewal preserves the annual anniversary. Rotating a key or editing entitlements does not by itself extend the term.

A valid cached binary and license can start and serve entitled requests without retaining `T9_API_KEY`. The adapter does not contact Tensor9 for each request. A Tensor9 outage does not stop that operation while the license remains valid. This does not promise indefinite disconnected operation or a dedicated air-gapped deployment workflow.

At final expiry, the adapter rejects new starts and new requests, including new requests on existing connections. Requests, streams and asynchronous work already admitted may finish normally; expiry does not force them to stop.

A license applies across Cloud Adapter product versions. Upgrading or rolling back does not require a new license solely because the binary version changes. A release containing a new adapter does not grant permission to use it.

## Troubleshoot authentication and access

| Problem                                       | Next step                                                                                                                                         |
| --------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- |
| `T9_API_KEY` is unset or empty                | Supply it in the current terminal or job, then repeat the non-printing check above.                                                               |
| Tensor9 rejects the key                       | Check the credential source and account with your administrator. Request a replacement if the key was revoked; never send the key to support.     |
| `whoami` reports the wrong account            | Stop and obtain the correct account's key before acquisition or renewal.                                                                          |
| The key works but the adapter is not entitled | Confirm the exact origin-to-backend direction and request that entitlement from Tensor9. Installing a newer binary does not grant it.             |
| The license is invalid or expired             | Check deployment of the signed license and complete authenticated renewal. Do not edit its contents.                                              |
| The target cloud rejects an operation         | Check the target-cloud identity and permissions. A working Tensor9 key does not grant access to cloud resources.                                  |
| Tensor9 is unreachable                        | Check connectivity and retry the online operation. Existing licensed operation continues until final expiry; do not delete a still-valid license. |

If a key is exposed, contact your account administrator or Tensor9 to revoke and replace it. Revocation prevents future API calls with that key; it does not instantly invalidate an already-issued offline license. Redact keys, licenses and authorization headers from logs and support bundles.

## Next step

Continue to [Getting Started](/cloud-adapter/getting-started/overview) to select a directed mapping and try a bounded request with test resources.