The Smallstep App

Smallstep ensures that access to financial data, code repositories, PII, and other sensitive resources is only possible from trusted devices.

The Smallstep desktop app offers a uniform experience for device identity across macOS, Windows, and Linux, and is foundational to Smallstep's high-assurance device attestation workflow, automating the enrollment and delivery of client certificates, and configuring the components that depend on them.

The Smallstep app operates differently for Linux. For Linux specific instructions, see Smallstep Agent for Linux.

The Smallstep App includes the Smallstep Agent, which runs in the background.

Installers for macOS, Windows and Linux can be also be downloaded from GitHub releases. Releases are signed with, and can be verified, by cosign.

• Windows 10 or later (Windows Home editions are not supported.)
• Trusted Platform Module (TPM 2.0)

• Flatpak, or Debian 12+, Ubuntu 22.04+, Fedora 38+
• systemd-based service manager
• Trusted Platform Module (TPM 2.0)
• p11-kit
• tpm-tss2

• macOS 13 (Ventura) or later
• Secure Enclave

All platforms require an internet connection for normal operation.

• Administrator privileges - the Smallstep app requires privilege escalation to be able to communicate to the TPM

• Location permission - to enable management of Wifi networks, the Smallstep app needs location permission
• Keychain access - the Smallstep app uses the macOS keychain to store both keys and certificates it manages
• Network Extension entitlement - the Smallstep app requests the Network Extension entitlement so that it can manage VPN connections

• TPM read/write permission - the Smallstep app communicates to the TPM from user-space using tpm-tss2, and the running user must have read/write permissions to the TPM resource manager (typically /dev/tpmrm0)

On all platforms, the Smallstep app creates and manages a directory on the filesystem in a well-known location for management of keys and certificates. However, it does not access any other file on a device except the one it creates.

• On macOS: $HOME/Library/Application Support/Smallstep
• On Windows: %LOCALAPPDATA%/Smallstep
• On Linux: $XDG_RUNTIME_DIR/step-agent and $XDG_CONFIG_HOME/step-agent

The Smallstep app collects and reports some data from the host device as part of its normal operation. These are:

• Device Identifiers from TPM-enabled platforms
• Device/Computer Name
• Device/Computer Hostname
• Chipset Architecture
• Operating System Version
• WAN IP Address