The one-liner install is the fastest way to wire up token tracking on a single workstation. It's the right path for a pilot, a demo, validating firewall rules, or letting a single engineer self-install. For fleet rollout use MDM instead.

What the one-liner does

The Torii AI Telemetry page shows a one-liner per (tool, OS) combination. On macOS and Linux it's a piped curl into bash; on Windows it's a PowerShell iwr that downloads the installer to %TEMP% and runs it.

Each one-liner:

1. Fetches the install script for that tool + OS from https://assets.toriihq.com/otel/latest/<script-name>.
2. Passes your ingest token to it as a flag. (The Torii endpoint is baked into the script; --endpoint exists only as an override for relays or staging.)
3. Detects the target user's home directory.
4. Makes a timestamped backup of the existing config file - only when the run actually changes it.
5. Writes the telemetry config to the right file for that tool.
6. Exits with a one-line summary of what was written.

The install scripts are idempotent - re-running is safe and produces the same end state, and a re-run that changes nothing skips the write (and the backup) entirely. They touch only the Torii-owned telemetry keys and preserve everything else in the config file (see What the LLM token tracking install scripts do for details).

Before you start

• You have the ingest token from the AI Telemetry page in Torii. (The endpoint, https://ai-events.toriihq.com, is baked into the script - there is nothing else to copy.) The token is shown masked in the page; click Copy on the token row to copy the unmasked value to your clipboard.
• The CLI you're configuring (Claude Code, Gemini CLI, or Codex CLI) is installed on the machine. The Torii install script writes the telemetry config, but it does not install the CLI itself.
• The machine has outbound HTTPS access to ai-events.toriihq.com and (on Linux only) to assets.toriihq.com.

macOS

Open Terminal on the target machine and paste the one-liner shown on the AI Telemetry page. The exact command depends on which CLI you want to instrument:

# Claude Code
curl -fsSL https://assets.toriihq.com/otel/latest/install-claude-code-telemetry-macos.sh \
  | bash -s -- --token <your-token>

# Gemini CLI
curl -fsSL https://assets.toriihq.com/otel/latest/install-gemini-cli-telemetry-macos.sh \
  | bash -s -- --token <your-token>

# Codex CLI
curl -fsSL https://assets.toriihq.com/otel/latest/install-codex-cli-telemetry-macos.sh \
  | bash -s -- --token <your-token>

What runs on the machine: the macOS installers use native osascript -l JavaScript (JavaScript for Automation, shipped with every macOS since 10.10) to merge JSON safely. No binaries are downloaded at install time. Security reviewers can read the macOS script end-to-end and see exactly what touches disk.

Where the config lands:

• Claude Code → ~/.claude/settings.json
• Gemini CLI → ~/.gemini/settings.json
• Codex CLI → ~/.codex/config.toml

Linux

The Linux one-liners look identical to macOS - just with -linux.sh in the URL:

# Claude Code
curl -fsSL https://assets.toriihq.com/otel/latest/install-claude-code-telemetry-linux.sh \
  | bash -s -- --token <your-token>

# Gemini CLI
curl -fsSL https://assets.toriihq.com/otel/latest/install-gemini-cli-telemetry-linux.sh \
  | bash -s -- --token <your-token>

# Codex CLI (no helper download - pure awk)
curl -fsSL https://assets.toriihq.com/otel/latest/install-codex-cli-telemetry-linux.sh \
  | bash -s -- --token <your-token>

What runs on the machine: the Claude Code and Gemini CLI Linux installers download a small statically-linked Go helper (ai-otel-helper, ~1 MB) from assets.toriihq.com/otel/latest/helper/linux-<arch>.gz, verify its SHA256 against a sidecar file, use it to do the JSON merge, and then delete it on exit. This exists because Linux distributions don't ship a built-in JSON parser, and we don't want to require jq / python3 / node on the workstation. The Codex installer uses pure awk on a TOML marker-block and downloads nothing.

Air-gapped Linux fleets: if workstations can't reach assets.toriihq.com directly, mirror the helper internally and set HELPER_BASE_URL before running. See Article 5 for the full procedure.

Where the config lands: same as macOS - ~/.claude/settings.json, ~/.gemini/settings.json, ~/.codex/config.toml.

Windows

Open PowerShell (regular, not elevated, unless you're installing system-wide) and run the two-step one-liner shown on the AI Telemetry page. Example for Claude Code:

iwr -useb 'https://assets.toriihq.com/otel/latest/install-claude-code-telemetry.ps1' `
  -OutFile "$env:TEMP\install-claude-code-telemetry.ps1"
& "$env:TEMP\install-claude-code-telemetry.ps1" -Token '<your-token>'

Substitute install-gemini-cli-telemetry.ps1 or install-codex-cli-telemetry.ps1 in both lines for the other two CLIs.

What runs on the machine: the PowerShell installers use native ConvertFrom-Json / ConvertTo-Json. No binaries are downloaded at install time.

Execution policy: if PowerShell refuses to run the script, prepend the second line with an execution policy bypass:

powershell -ExecutionPolicy Bypass -File "$env:TEMP\install-claude-code-telemetry.ps1" -Token '<your-token>'

Where the config lands:

• Claude Code → %USERPROFILE%\.claude\settings.json
• Gemini CLI → %USERPROFILE%\.gemini\settings.json
• Codex CLI → %USERPROFILE%\.codex\config.toml

Verify it worked

You will see a one-line summary like:

wrote /Users/alice/.claude/settings.json - env (token …a1b2, host=Alice-MBP serial=ABC123 user=alice, log_prompts=0)

To prove end-to-end the telemetry is flowing, open the AI Telemetry page in Torii for the CLI you just configured, then run a test event on the workstation. See Verifying your setup for the exact commands. The expected per-tool test command is:

• Claude Code: echo "hello torii" | claude --print --output-format text
• Gemini CLI: gemini -p "hello torii"
• Codex CLI: codex exec "hello torii"

The event tail on the AI Telemetry page updates within ~5 seconds.

If you'd rather not pipe a script into bash

The one-liner is just a thin invocation of a published install script. If your environment forbids piping curl into bash, see Manual install for the static JSON / TOML blocks you can write directly into the config files.

Next steps

• Verify your setup - send a test event
• Uninstall token tracking
• Troubleshooting and FAQ