Download, install and connect the routing client

When to use this workflow

Connect your own model server as an IAM.Router worker. iam-router-client is a command-line process receiving tasks from task-engine and invoking the configured model server. Each archive contains the executable, client.env.example, README.txt and VERSION.txt. Install the model server and weights separately.

To send application requests through the OpenAI-compatible API, use an application API key; installing a worker is not required.

Prerequisites

Access to Clients and permission to create a key for the intended Tenant ID. Ask an administrator if the action is unavailable.
An operator-supplied task-engine address in HOST:PORT format, reachable over a trusted network or VPN. https://app.iamrouter.ru/ and https://api.iamrouter.ru/v1 are not worker gRPC addresses. The example default localhost:9091 applies only to a local task-engine.
An operational model server. These examples assume an already installed Ollama at http://127.0.0.1:11434; check its available models with ollama list.

Build 20261014-r1 uses gRPC without TLS. The operator must provide a trusted transport; do not expose its port directly to the internet. The archives are CLI workers, not standalone DLP agents or graphical applications. The macOS build is not notarized and Windows has no Authenticode signature. SHA256 verifies integrity, not publisher identity. If system or corporate policy blocks execution, request an approved distribution from your administrator.

Download from Clients

Open IAM.Router → Clients, sign in and select the intended tenant.
Under Download routing client, select an operating system and architecture using the table below. Downloads are available even when no workers are connected.
Click SHA256 to download SHA256SUMS. Connection guide opens the brief instructions for the same build.
Click Create key, enter Tenant ID, an optional Label and Expiry date. Keep the strict Secure/Router policy mode when the connection must follow corporate policy.
Click Create and store the returned value securely. Do not include it in screenshots, messages or repositories. The full value may no longer appear after closing the reveal dialog.

**Clients page: downloads on staging; account and worker data are outside the capture**
2026-10-15 · Actual app.stage.iamrouter.ru application, build 20261014-client-downloads-r1. Public download controls only; original pixels are unchanged.

The screenshot comes from the actual staging application; account and worker details are outside the frame. Controls match the released build. Numbered annotations are separate documentation layers; screenshot pixels are unchanged. The Russian labels remain as captured.

Platform	Download button	Build 20261014-r1 archive
macOS, Apple Silicon	Apple Silicon · ARM64	macOS ARM64
macOS, Intel	Intel · x64	macOS x64
Linux, x86_64	x64	Linux x64
Linux, aarch64 / ARM64	ARM64	Linux ARM64
Windows, x64	x64	Windows x64

Check macOS/Linux architecture with uname -m; on Windows use Settings → System → About → System type. Choose ARM64 on Apple Silicon even if a terminal runs under Rosetta. No Windows ARM64 package is published in this version.

Install on macOS

Save the archive and SHA256SUMS in Downloads, then open Terminal:

cd ~/Downloads
shasum -a 256 iam-router-client-macos-arm64.tar.gz

Compare the result with the matching filename in SHA256SUMS. On mismatch, download again and do not run it. For Intel, replace arm64 with x64 throughout this subsection.

tar -xzf iam-router-client-macos-arm64.tar.gz
cd iam-router-client-macos-arm64
cp client.env.example client.env
chmod 600 client.env

Edit client.env and use the startup instructions below.

Install on Linux

Save the files in your user directory. For x64:

cd ~/Downloads
sha256sum iam-router-client-linux-x64.tar.gz
tar -xzf iam-router-client-linux-x64.tar.gz
cd iam-router-client-linux-x64
cp client.env.example client.env
chmod 600 client.env

Before extraction or execution, compare the hash with SHA256SUMS. Replace x64 with arm64 for ARM64. Extraction and foreground startup need no administrator privileges. If the executable permission was lost, run chmod u+x iam-router-client after verifying integrity.

Configure and start on macOS/Linux

Edit client.env, replacing the key and task-engine address with operator-approved values. task-engine.example.invalid is an intentionally unusable example:

AUTH_TOKEN='REPLACE_WITH_YOUR_KEY'
TASK_ENGINE_GRPC_ADDR=task-engine.example.invalid:9091
TASK_ENGINE_URL=
CLIENT_NAME=workstation-router
CLIENT_TAGS=iamrouter,local
PARALLEL_WORKERS=1
OLLAMA_ENABLED=true
OLLAMA_URL=http://127.0.0.1:11434
BRAINLM_ENABLED=false
VLLM_ENABLED=false
AVAILABLE_MODELS=

An empty AVAILABLE_MODELS makes the client discover models from Ollama. Advertise only models actually served. The empty TASK_ENGINE_URL prevents unintended use of the default local HTTP endpoint; the operator may provide a separate HTTP configuration.

Load the variables and start from the extracted directory:

set -a
. ./client.env
set +a
./iam-router-client

The client does not automatically load client.env. Keep the terminal open; Ctrl+C stops it. For an unattended service, use an operator-approved supervisor/systemd/launchd configuration and keep the key out of command lines and logs.

Install and start on Windows

From the download directory in PowerShell, verify the archive hash against SHA256SUMS:

Get-FileHash .\iam-router-client-windows-x64.zip -Algorithm SHA256
Expand-Archive -Path .\iam-router-client-windows-x64.zip -DestinationPath .\router-client
Set-Location .\router-client\iam-router-client-windows-x64

In the same window, replace the educational credential and address placeholders:

$env:AUTH_TOKEN = "REPLACE_WITH_YOUR_KEY"
$env:TASK_ENGINE_GRPC_ADDR = "task-engine.example.invalid:9091"
$env:TASK_ENGINE_URL = ""
$env:CLIENT_NAME = "windows-router"
$env:CLIENT_TAGS = "iamrouter,local"
$env:PARALLEL_WORKERS = "1"
$env:OLLAMA_ENABLED = "true"
$env:OLLAMA_URL = "http://127.0.0.1:11434"
$env:BRAINLM_ENABLED = "false"
$env:VLLM_ENABLED = "false"
$env:AVAILABLE_MODELS = ""
.\iam-router-client.exe

Variables belong to the current PowerShell process. Ctrl+C stops the worker. Use your organisation’s approved secret handling instead of a publicly readable .ps1. Native Windows execution is not part of the confirmed qualification of this build: the published x64 archive and SHA256 were verified, but the installation operator must confirm the complete Windows workflow.

Verify the connection

Keep the process running, return to Clients, then click Refresh.
Find the configured CLIENT_NAME. Check online, Active, Threads and a recent Last heartbeat.
Open Client models using the cube icon on the card. Confirm that the advertised models match the operational local server.
Ask the operator to dispatch a safe educational task to this specific model/worker. Locate it under Request history → Client tasks, comparing time and identifier. A normal Router request can use another provider; a card or key alone does not prove execution by this worker.

**macOS, Linux and Windows downloads on mobile staging**
2026-10-15 · Actual app.stage.iamrouter.ru application, build 20261014-client-downloads-r1. Public download controls only; original pixels are unchanged.

Recover from errors

Symptom	Check
`AUTH_TOKEN environment variable is required`	Load `client.env` with `set -a` / `. ./client.env` / `set +a`; on Windows set `$env:AUTH_TOKEN` in the same window.
Unauthorized / 401	Tenant ID, expiry, revocation and worker permissions. The operator must confirm task-engine access; an IAM.Identity session does not replace `AUTH_TOKEN`.
Connection refused / timeout / Unavailable	Operator-supplied `HOST:PORT`, VPN, firewall and task-engine health. The HTTPS console URL and default localhost address are unsuitable for a remote worker.
Card present but offline	A running client, network connectivity and heartbeat. Reopening the terminal requires reloading environment variables.
Online but no models / tasks fail	`OLLAMA_URL`, `ollama list`, provider configuration, route permissions and exact model identifiers.
Wrong architecture / OS blocks execution	Select the correct archive and request approved signing/distribution; do not bypass corporate policy.

After rotating the key, update the secure configuration and restart. When retiring a worker, stop it and separately revoke its key in Access keys. Deleting the card or disabling Active does not revoke the credential.

Clients reference · Create an API key · Check a route