Install links, end to end

Install links are how you enroll Macs without an MDM. The console mints a per-employee URL; opening it downloads a small kit; the employee double-clicks a standard macOS installer package and types their Mac password. That is the whole employee-facing flow — no Terminal, no scripts, no pasted commands.

This page walks the entire path, because knowing what happens between “the installer said done” and “the device shows up” is the difference between a calm rollout and a support queue.

1. Mint the links

On the Employees page, click Create install links, pick the employees, and create. Each selected employee gets their own URL.

Copy the links immediately — they are shown once. Only their hashes are stored, so a link you didn’t copy is a link you re-mint. Send each link to its employee through a channel your staff already recognize; each one is a credential bound to that person.

If your deployment isn’t ready — no installer package registered, or no agent release promoted yet — the console refuses to create links and tells you why, right in the dialog. Nothing is minted. That is deliberate: a link that can’t produce a working installer should fail in front of you, not in front of an employee three days later.

Links expire (72 hours by default, configurable per batch) and can be revoked at any time from the Employees page. Revoking a link kills everything inside any kit downloaded from it, immediately — not at expiry.

2. What the employee downloads

Opening the link downloads a zip containing four files:

File	What it is
AstralinkDLP-bootstrap-…pkg	A small, Apple-notarized installer — the same one MDM fleets use
config.json	Which AstraLink backend this Mac should talk to
token.txt	Their single-use, employee-bound enrollment token
README.md	The two-step instructions, and what to expect

Each download is personalized on the spot. Downloading again invalidates the previous kit — only the newest one works — so a link forwarded or leaked yesterday dies the moment the employee fetches a fresh copy.

Keep the folder together

The installer reads config.json and token.txt from beside itself. If the .pkg is moved out of the folder (or AirDropped on its own), it installs nothing and the README says how to recover: put it back, or re-download the kit. Installing twice is safe.

3. The employee’s two steps

1. Double-click the .pkg. macOS Installer opens, asks for their Mac password — the same prompt they’ve seen their whole life — and reports success within seconds.

2. Turn on Input Monitoring when System Settings opens a few minutes later (Privacy & Security → Input Monitoring). macOS allows no installer, MDM, or admin to grant this; only a person at the machine can.

That’s the entire ask. Everything else is automatic.

4. What happens in the background

The installer’s own job is small, which is why it finishes fast. It validates the kit’s configuration and hands off to a one-shot background worker, which then:

1. Asks your AstraLink backend which agent version is currently released. The kit doesn’t carry a frozen version — it installs whatever is promoted when the employee runs it, the same version an MDM install or an automatic update would deliver. A kit downloaded Friday and run Monday installs Monday’s release.
2. Verifies before installing. The answer must carry a valid AstraLink release signature, the downloaded package (several hundred MB) must match the signed checksum, and it must be signed by AstraLink’s Apple Developer ID. Fail any check and nothing installs.
3. Installs the agent and hands it the enrollment token. The agent enrolls the Mac to that employee, under that employee’s policy, and the spent token is deleted.

Set expectations: fast installer, then a quiet few minutes

The Installer window reports success almost immediately, then the agent download continues in the background for a few minutes. This gap is the #1 “did it work?” question in a rollout — the in-kit README explains it to the employee, and your rollout comms should too. The visible end of the wait is the Input Monitoring prompt appearing.

What protects the credentials in the kit

The kit sits in a Downloads folder, so it is built to be safe there:

• The installer package is notarized and tamper-evident. A modified package fails Apple’s Gatekeeper check and won’t open.
• The configuration beside it is validated before use. The installer refuses a config.json pointing anywhere other than AstraLink’s own domains — a tampered kit cannot redirect the enrollment token to another server. A refused kit still installs the agent; the device just waits for a token by another route.
• The token works once, for one employee. Spent, expired, or superseded tokens are inert. Re-downloading or revoking the link revokes everything a previous kit carried.
• The kit’s backend credential is scoped and short-lived. It can ask “which release should I install?” and nothing else, and it expires with the link.

When something goes wrong

Symptom	What it means	Fix
”Apple cannot check it for malicious software”	Damaged or incomplete download	Re-download the kit from the link
Link says expired or already used	Links are single-use and time-limited	Revoke and re-mint from the Employees page
Installer succeeded, no device after ~10 minutes	Usually a separated kit or a network block	Check /var/log/astralink-bootstrap.log on the Mac — every step and every refusal is one line there
Console refuses to create links	No installer registered or no release promoted	The dialog names which; both are deployment-side fixes
Device shows Attention with a token problem	The kit’s configuration was unusable on that Mac	Re-mint that employee’s link; the fresh kit supersedes the old one

The device appears on the Devices page once enrolled — same verification as every other path, covered in Device statuses.