Hosted build quickstart

Choose the exact unsigned .jar or .zip produced by your release build. Do not submit sources, Javadoc, tests, an already protected artifact, or a signed release. Run ordinary tests and a lightweight smoke test against that exact input before submitting it.

Create a scoped API key in the dashboard with build:write, build:read, and artifact:read. Store the one-time secret only in your CI secret store as NATIVIFY_API_KEY. A build is paid and submit is non-idempotent: never automatically replay an ambiguous POST.

bash

java -jar target/app.jar --version
NATIVIFY_PLATFORMS=linux-x86_64 ci/nativify.sh target/app.jar target/app-nativified.jar
java -jar target/app-nativified.jar --version

linux-x86_64 is an example, not a safe default. Supply the complete, audited release target set explicitly. After a successful build, smoke-test the protected JAR on every requested OS/architecture target before signing or publishing. The protected output, not the input, must flow into signing, attestation, and publication.

The output also has a default private hosted path. Authenticate with a dashboard JWT or an nfy_ key carrying artifact:read; the service then authorizes the exact task and its owner/resource boundary before sending the JAR as a private, non-cacheable attachment. Copy it into your controlled release storage before signing or publishing.