# Authentication & installation

Browser sign-in and developer credentials serve the same ownership checks, but their setup is currently separate.

## Browser access

Use GitHub or a confirmed email account at [Security.Run](/signup/). The website manages your browser sign-in session and its refresh. There is no API-key sign-in form in the browser.

## CLI and SDK access

The current developer release requires a bearer API credential provisioned by the deployment operator. There is no self-service API-key creation screen or browser-based `sr login` flow yet. Contact [support@security.run](mailto:support@security.run) for developer access and repository installation access.

Ask the operator to associate your developer credential with the same account identity as your browser account. Credentials assigned to different identities have separate sessions and credit balances. A valid credential alone does not supply credits.

`SECURITY_RUN_API_KEY` is the environment variable's name; use the issued Security.Run credential. Do not put a Stripe key, a browser publishable key, or VM credentials in it. Keep it on your computer or server, never in a frontend bundle or source control.

## Install Python and the CLI

Python **3.10 or later** is required. From your Security.Run repository checkout:

```bash
python3 -m venv .venv
source .venv/bin/activate
python -m pip install -e .
sr --help
```

On Windows PowerShell, use the equivalent virtual environment activation:

```powershell
py -m venv .venv
.\.venv\Scripts\Activate.ps1
python -m pip install -e .
sr --help
```

This installs both the `security_run` Python package and the `sr` command. The OS-session command is `sr`; other legacy commands in the repository are not this product's CLI.

## Configure the CLI

Run the interactive prompt, which hides the credential while you enter it:

```bash
sr login
sr credits
```

`sr login` validates access by listing sessions, then creates `~/.security-run/config.json` with private file permissions. It saves the credential, not a new browser login. It deliberately refuses to overwrite an existing configuration file.

For a separate deployment or a replacement credential, use a new config path. Global options come **before** the subcommand:

```bash
sr --url https://your-deployment.example --config ~/.security-run/pilot.json login
sr --config ~/.security-run/pilot.json images
```

Replace the example hostname with your operator's actual endpoint. The public endpoint defaults to `https://www.security.run`.

The CLI takes the credential from `SECURITY_RUN_API_KEY` when set, otherwise from its config file. URL precedence is `--url`, then `SECURITY_RUN_URL`, then the saved URL, then the public default.

## Configure a Python or Node.js project

The SDKs read environment variables or explicit constructor arguments. They **do not read the file created by `sr login`**. Supply the issued credential through your shell, development environment, or CI secret store.

For a temporary Bash session, read it without displaying it or recording it as a command literal:

```bash
read -r -s -p 'Security.Run API credential: ' SECURITY_RUN_API_KEY
printf '\n'
export SECURITY_RUN_API_KEY
```

In zsh, use `read -r -s 'SECURITY_RUN_API_KEY?Security.Run API credential: '` instead. Set `SECURITY_RUN_URL` only for a different deployment. `.env` files are not loaded automatically by either SDK.

Python constructor options:

```python
import os
from security_run import Client

client = Client(
    api_key=os.environ["SECURITY_RUN_API_KEY"],
    base_url="https://www.security.run",
)
client.close()
```

Node.js constructor options:

```javascript
import { Client } from '@security-run/sdk';

const client = new Client({
  apiKey: process.env.SECURITY_RUN_API_KEY,
  baseUrl: 'https://www.security.run',
});
```

## Install the JavaScript / TypeScript SDK

Use **Node.js 20 or later**. From your application directory:

```bash
npm install /absolute/path/to/security-run/sdk/javascript
```

Replace that path with your checkout. The package name is `@security-run/sdk`; it ships ESM JavaScript and TypeScript declarations. Use `.mjs` files or set `"type": "module"` in your project's `package.json`. Do not assume `npm install @security-run/sdk` or `pip install security-run` fetches this release from a public registry; these packages are currently distributed through the repository.

Continue with the [CLI guide](/docs/cli/), [Python guide](/docs/python/), or [JavaScript & TypeScript guide](/docs/javascript/).