The full operating procedure is in CUSTOMER_SOP.md. This guide is the short customer installation path.

This guide is for the person who installs AION, manages its runtime settings and gives a tester access to the gateway. It does not require source code or a Go toolchain.

1. Prepare the host

Use a Linux host with Docker and Docker Compose v2. On Windows, use Ubuntu under WSL2 with Docker Desktop WSL integration. Store the bundle under the WSL home directory, such as ~/aion, not under /mnt.

Confirm the tools:

docker --version
docker compose version

2. Download the approved bundle

After Infivector approves the pilot request, the portal provides two downloads: the shared signed bundle and your signed license.json. The archive contains signed product defaults, release verification tools and a smoke-only validation license that cannot run a customer deployment.

Verify the archive checksum shown by the portal before extraction. Then unpack the archive, enter its directory and save the separately downloaded customer license there as license.json.

Do not edit license.json, aion-enterprise.yaml, bundle-manifest.sha256 or release-manifest.json.

3. Verify before installing

Run:

./init-pilot.sh

The initializer verifies the immutable signed bundle first. It then verifies the separately signed customer license and required feature entitlements. A failure at either step stops the installation. Warnings for missing runtime secrets are expected before the first install.

4. Prepare the credentials

The credentials have different owners and purposes:

• The Bedrock token comes from AWS Bedrock and lets AION call the upstream models.
• The gateway API key is a new operator-created secret of at least 16 characters. Claude or Codex sends this value to AION.
• The dashboard token is a separate operator-created secret of at least 32 characters. It bootstraps the first named local administrator.
• The one-time activation token comes from the Infivector portal and binds this licence to the customer cluster.

Use a password manager or secret manager. Do not reuse a value or paste one into Git, documentation or shell history.

5. Install

Run:

./install.sh --secret-files

The installer verifies the bundle again, creates the unsigned customer-config.yaml, writes secrets under ./secrets, loads the bundled images and waits for license health. Rerunning the command preserves existing signing keys. Do not use --rotate-keys during a normal reinstall or upgrade.

6. Set the budget or provider

Edit customer-config.yaml, never the signed base config. To enforce a USD 3 daily cap for the default gateway key, add:

auth:
  keys:
    - key: "${AION_API_KEY}"
      name: "default"
      budget:
        daily_limit_usd: 3.0
        monthly_limit_usd: 90.0

Restart and check the deployment:

docker compose up -d
./post-install-check.sh

For a provider other than Bedrock, set AION_PROVIDER_MODE=custom before installation and follow docs/PROVIDER_COMPATIBILITY.md.

7. Verify the deployment

Run the no-spend checks first:

./post-install-check.sh
curl -fsS http://localhost:8080/healthz/license
curl -fsS http://localhost:8080/healthz/readiness

Then run the one-time live setup check. This sends provider traffic and can incur a small charge:

./complete-setup-check.sh --base-url http://localhost:8080

Open http://localhost:8080/dashboard and sign in with the bootstrap token. Open Local access and create the first named administrator. Sign in again with that local account. The bootstrap token is no longer accepted after the first user exists. Use the dashboard cost view and signed evidence status to confirm that the live request was recorded.

8. Give a tester gateway access

Give the tester only these values:

• the HTTPS gateway base URL ending in /v1
• the gateway API key
• the approved model ID

Do not give the tester the Bedrock token, dashboard token, license file or AWS credentials. Deliver the gateway key through a password manager or another approved secret channel.

For Claude Code, set the Anthropic-compatible gateway URL and place the AION gateway key in the standard Anthropic client variable:

export ANTHROPIC_BASE_URL="https://gateway.example.com"
read -rsp "AION gateway key: " ANTHROPIC_API_KEY
export ANTHROPIC_API_KEY
printf '\n'
claude --model aion-auto

For Codex, add a custom provider to ~/.codex/config.toml:

model = "aion-auto"
model_provider = "aion"

[model_providers.aion]
name = "AION Gateway"
base_url = "https://gateway.example.com/v1"
env_key = "AION_API_KEY"
wire_api = "responses"

Then load the key without placing it in the config file or shell history:

read -rsp "AION gateway key: " AION_API_KEY
export AION_API_KEY
printf '\n'
codex

Other clients send Authorization: Bearer <gateway-key> over HTTPS. Anthropic clients may send the same value in x-api-key. Keep the tester's client configuration separate from the AION host configuration. More client setup details are in docs/CLIENT_SETUP.md.

9. Collect test evidence

For each bug report, record the timestamp, client, model, HTTP status and AION request ID. Do not copy prompts, responses or secrets into a shared issue unless the test data is approved for disclosure.

Collect these operator artifacts when a failure occurs:

docker compose ps
docker compose logs --since 15m aion-enterprise
./post-install-check.sh

Redact credentials before sharing logs outside the operator team.