Install and set up Durin Endpoint Client

Choose your installer

Open the Durin Endpoint Client page and choose your operating system. The page lists approved stable installers with their version, architecture, minimum OS and checksums. If no installer is available, wait for an approved release or ask your administrator.

macOS includes local session viewing and detection hooks. Windows and Linux currently provide local Claude Code and Codex session viewing, organization sign-in and application updates.

• Get Durin Endpoint Client

Install on macOS

Requires macOS 14 or later. The universal installer supports Apple silicon and Intel. The installed macOS application is named Durin Observer.

1. Download the macOS disk image (.dmg) from the Endpoint Client page.
2. Open the disk image and drag Durin Observer to Applications.
3. Open Durin Observer from Applications. The app reads your local Claude Code and Codex history locations; use Sources & settings to choose a different folder if needed.

Install on Windows

Requires Windows 10, version 1809 or later, on x64. The installer installs for your user account.

1. Download the Windows installer (.exe) from the Endpoint Client page.
2. Run the installer and follow the setup instructions.
3. Launch Durin Endpoint Client from the Start menu.

Install on Linux

Requires an x64 graphical desktop with glibc 2.35 or later, such as Ubuntu 22.04. Organization sign-in also requires an unlocked Secret Service credential store.

1. Download and extract the Linux archive (.tar.gz) from the Endpoint Client page.
2. Open a terminal in the extracted folder and run ./install.sh as your normal user. It installs under ~/.local/share/durin-endpoint and adds an application launcher.
3. Open Durin Endpoint Client from your application launcher.

Verify your download

Expand Verify download for your installer on the Endpoint Client page. Calculate the downloaded file’s SHA-256 hash and compare it with the displayed value. For macOS and Windows, verify the installer’s native signature as well. The Linux archive has a signed release manifest linked in the verification panel. SHA-1 is provided for compatibility; it is not the primary verification method.

• macOS Terminal: shasum -a 256 "path/to/installer.dmg"
• Windows PowerShell: Get-FileHash -Algorithm SHA256 "C:\path\to\installer.exe"
• Linux terminal: sha256sum "path/to/archive.tar.gz"

Replace the example path with the downloaded file’s location. The verification panel also links to checksum files and the signed release manifest. Do not use a file whose hash does not match.

Connect your organization

Organization sign-in connects this device to your Durin membership for organization-approved updates. On macOS it also enables reporting of new detection flags as metadata. Local session viewing does not require organization sign-in.

1. On macOS, open Sources & settings and find Organization. On Windows or Linux, use Sign in to an organization in the toolbar.
2. Start sign-in and follow the browser window opened by the client. Sign in to your Durin account, check that the displayed device code matches the client, and approve it for the intended organization.
3. Return to the client and confirm the organization name. If sign-in is unavailable, ask your administrator to review membership and the organization’s Endpoint Client setting.

Secure update connections

Production clients require the update service to present a trusted TLS certificate whose public key matches an identity included in the installed app. They also verify signed release metadata and update content. If certificate verification fails, the client stops the update and keeps the installed application available.

A network security proxy that replaces the service certificate can prevent update checks. Ask your administrator to review the connection to endpoint-patcher.getdurin.com. Do not disable certificate verification. If the service keys have changed beyond those supported by your installed version, recovery may require a new signed installer from the Endpoint Client page.

• Get the approved installer

Manage application updates

Signed production builds enable automatic updates by default. While the app is open and automatic updates are enabled, it checks about every 30 minutes. Signed-in devices receive only releases approved for their organization. Installation may restart the app.

• macOS: use Check for Application Updates… in the app menu, or the application-update controls in Sources & settings.

• Windows and Linux: use Check for updates in the toolbar. Install approved updates automatically controls automatic checks and installation.

• You can turn automatic updates off in the app and check manually. Manual checks still follow release approval.

• If an enrolled device loses access to its credentials or its sign-in expires, update checks stop. Unlock the credential store or sign in again. Choosing Sign out explicitly switches this device to public approvals.

• Older builds without an application updater need one manual installation from the Endpoint Client page before automatic updates can work.

• Download the approved installer