Lowkey installer CLI reference: all flags and usage

The Lowkey installer is the script you get from install.lowkey.run. You can run it interactively (it walks you through every choice) or pass flags to skip the prompts entirely. This page covers every flag, the environment variables the installer respects, and the exit codes it returns.

Flag reference

Flag	Purpose
`-y`, `--yes`, `--non-interactive`	Accept all defaults and skip every prompt. Required for unattended or CI installs.
`--simple`	Force simple mode — only asks for pack and profile, auto-configures everything else.
`--advanced`	Force advanced mode — prompts for every parameter (VPC, instance type, each security service, etc.).
`--pack <name>`	Pre-select the agent pack. Valid values: `openclaw`, `claude-code`, `codex-cli`, `kiro-cli`, `nemoclaw`, `hermes`, `pi`, `ironclaw`.
`--profile <name>`	Pre-select the permission profile. Valid values: `builder`, `account_assistant`, `personal_assistant`.
`--method <cfn\|terraform\|tf>`	Pre-select the deploy method. Default is CloudFormation via CLI (`cfn`). Use `terraform` or `tf` for Terraform.
`--kiro-from-secret <id-or-arn>`	Secrets Manager secret id or ARN whose `SecretString` is your Kiro API key. Only the reference passes through deploy state — the raw key is resolved on the instance at install time.
`--debug-in-repo`	Dev-only flag: run the installer from the current working directory instead of cloning from GitHub.
`--help`, `-h`	Print the help text and exit.

Any explicit flag wins over an environment variable, which wins over the pack manifest default.

Canonical non-interactive invocations

Use -y combined with --pack and --profile to deploy without any prompts.

curl -sfL install.lowkey.run | bash -s -- -y \
  --pack openclaw --profile builder

curl -sfL install.lowkey.run | bash -s -- -y \
  --pack claude-code --profile builder

curl -sfL install.lowkey.run | bash -s -- -y \
  --pack codex-cli --profile builder

After the stack reaches CREATE_COMPLETE, SSM into the instance and run codex login to authenticate.

curl -sfL install.lowkey.run | bash -s -- -y \
  --pack kiro-cli --profile builder \
  --kiro-from-secret /lowkey/kiro-api-key

Store your Kiro API key in Secrets Manager first. See Managing secrets with AWS Secrets Manager.

curl -sfL install.lowkey.run | bash -s -- -y \
  --pack nemoclaw --profile personal_assistant

NemoClaw requires the personal_assistant profile — its sandbox blocks all AWS API access.

curl -sfL install.lowkey.run | bash -s -- -y \
  --pack openclaw --profile account_assistant

Terraform deploy method

Pass --method terraform to have the installer run Terraform instead of CloudFormation:

curl -sfL install.lowkey.run | bash -s -- -y \
  --pack openclaw --profile builder \
  --method terraform

The installer runs terraform init → validate → apply -auto-approve under deploy/terraform/. If you want to review the plan before it applies, deploy Terraform directly instead — see Deploy Lowkey with Terraform.

Advanced mode

Advanced mode prompts for every parameter: VPC reuse, instance type, data volume size, region, and each security service individually. Pass --advanced to enable it, even alongside -y:

curl -sfL install.lowkey.run | bash -s -- -y \
  --pack openclaw --profile builder \
  --advanced

Advanced mode still honors -y for prompts that have a clear safe default. It only stops to ask for choices that genuinely need a decision.

Connect via SSM after install

SSH is disabled by default (SSHAllowedCidr=127.0.0.1/32). Once your stack reaches CREATE_COMPLETE, connect using AWS Systems Manager Session Manager:

aws ssm start-session --target <instance-id> --region <region>

Find the instance ID in the CloudFormation stack Outputs tab, or retrieve it from the CLI:

aws cloudformation describe-stacks \
  --stack-name <stack-name> \
  --query 'Stacks[0].Outputs[?OutputKey==`InstanceId`].OutputValue' \
  --output text

To enable SSH, redeploy in advanced mode and set SSHAllowedCidr to your IP CIDR (for example, 1.2.3.4/32).

Environment variables honored

Set these in your shell before piping the installer to bash:

Variable	Effect
`AWS_REGION` / `AWS_DEFAULT_REGION`	Sets the deploy region. Overrides the AWS CLI profile default.
`AWS_PROFILE`	Uses the named AWS CLI profile for all AWS API calls during install.
`DEBUG_IN_REPO=1`	Equivalent to `--debug-in-repo`. Runs the installer from the current directory instead of cloning.

Exit codes

Code	Meaning
`0`	Install succeeded.
`1`	Install failed — check stderr and `/tmp/loki-install.log`.
`2`	Bad arguments — unknown flag or missing required value.
`130`	Interrupted by Ctrl-C or SIGTERM.

CLI

Deploy

Security

Telemetry

Lowkey installer CLI reference: all flags and usage

Flag reference

Canonical non-interactive invocations

Terraform deploy method

Advanced mode

Connect via SSM after install

Environment variables honored

Exit codes

​Flag reference

​Canonical non-interactive invocations

​Terraform deploy method

​Advanced mode

​Connect via SSM after install

​Environment variables honored

​Exit codes

Flag reference

Canonical non-interactive invocations

Terraform deploy method

Advanced mode

Connect via SSM after install

Environment variables honored

Exit codes