Deploy as a binary

Download the latest release for your platform from the Deployment Center

Extract the archive

Extract the .zip or .tar.gz in the directory you want to run Enterprise Studio.

Configure

Enterprise Studio expects a config.yaml file in the same directory as the binary. If you have not created one yet, see Configuration for the required settings and a minimal example. For handling passwords and client secrets, see Security → Secrets management.

Run the binary

On Linux:

./nes

On Windows:

./nes.exe

Once running, open http://localhost in your browser (or http://localhost:<YOUR_PORT>; if you configured a custom port).

Cloud Secrets Managers

If config.yaml uses Secrets Manager references (usernameFrom, passwordFrom, or clientSecretFrom), give the process cloud credentials through the provider’s default credential chain — do not put access keys in config.yaml. Secret shape and required permissions are covered under Configuration → Secrets Manager.

In production, use an attached identity on the host. For local development, sign in with the cloud CLI in the same shell session where you start Enterprise Studio (./nes), so the process inherits the credentials.

Provider Production identity Local / development

AWS

EC2 instance profile

aws login, or aws sso login. Use AWS_PROFILE if you use a named profile.

Azure

Azure managed identity

az login

Google Cloud

Attached service account

gcloud auth application-default login

Troubleshooting

The following are are some known common platform-specific issues:

Service won’t start (Mac)

MacOS binaries are not available. Use Deploy with Docker instead.

Permission denied (Linux)

Make the binary executable first:

chmod +x ./<binary-name>
Service won’t start

Ensure that config.yaml exists in the same directory as the binary and is valid YAML. Verify that all database URIs are accessible from this machine and that the configured port is not already in use.

Static files not loading

Ensure that the port Enterprise Studio is running on is accessible and not blocked by a firewall.

Outbound TLS trust (private CAs)

When Neo4j deployments or asset storage use HTTPS or Bolt+TLS with a private CA, Enterprise Studio must trust that CA to connect successfully. Enterprise Studio relies on the standard system trust store. There is no Enterprise Studio configuration setting for outbound TLS trust.

See Security → TLS encryption for the trust model. Restart Enterprise Studio after installing or updating trust store entries.

Linux

Add the upstream CA using your distribution’s mechanism so it is included in /etc/ssl/certs. On Debian and Ubuntu:

sudo cp neo4j-ca.pem /usr/local/share/ca-certificates/neo4j-ca.crt
sudo update-ca-certificates

If SSL_CERT_DIR is set in the environment where Enterprise Studio runs, place trusted CAs in that directory instead.

Windows

Import the upstream CA into the local machine trusted root store. Run from an elevated Command Prompt or PowerShell:

certutil -addstore -f Root C:\path\to\neo4j-ca.crt

Alternatively, in PowerShell:

Import-Certificate -FilePath C:\path\to\neo4j-ca.crt -CertStoreLocation Cert:\LocalMachine\Root