Authentication & installation

Browser sign-in and developer credentials serve the same ownership checks, but their setup is currently separate.

Browser access

Use GitHub or a confirmed email account at Security.Run. The website manages your browser sign-in session and its refresh. There is no API-key sign-in form in the browser.

CLI and SDK access

The current developer release requires a bearer API credential provisioned by the deployment operator. There is no self-service API-key creation screen or browser-based sr login flow yet. Contact support@security.run for developer access and repository installation access.

Ask the operator to associate your developer credential with the same account identity as your browser account. Credentials assigned to different identities have separate sessions and credit balances. A valid credential alone does not supply credits.

SECURITY_RUN_API_KEY is the environment variable's name; use the issued Security.Run credential. Do not put a Stripe key, a browser publishable key, or VM credentials in it. Keep it on your computer or server, never in a frontend bundle or source control.

Install Python and the CLI

Python 3.10 or later is required. From your Security.Run repository checkout:

python3 -m venv .venv
source .venv/bin/activate
python -m pip install -e .
sr --help

On Windows PowerShell, use the equivalent virtual environment activation:

py -m venv .venv
.\.venv\Scripts\Activate.ps1
python -m pip install -e .
sr --help

This installs both the security_run Python package and the sr command. The OS-session command is sr; other legacy commands in the repository are not this product's CLI.

Configure the CLI

Run the interactive prompt, which hides the credential while you enter it:

sr login
sr credits

sr login validates access by listing sessions, then creates ~/.security-run/config.json with private file permissions. It saves the credential, not a new browser login. It deliberately refuses to overwrite an existing configuration file.

For a separate deployment or a replacement credential, use a new config path. Global options come before the subcommand:

sr --url https://your-deployment.example --config ~/.security-run/pilot.json login
sr --config ~/.security-run/pilot.json images

Replace the example hostname with your operator's actual endpoint. The public endpoint defaults to https://www.security.run.

The CLI takes the credential from SECURITY_RUN_API_KEY when set, otherwise from its config file. URL precedence is --url, then SECURITY_RUN_URL, then the saved URL, then the public default.

Configure a Python or Node.js project

The SDKs read environment variables or explicit constructor arguments. They do not read the file created by sr login. Supply the issued credential through your shell, development environment, or CI secret store.

For a temporary Bash session, read it without displaying it or recording it as a command literal:

read -r -s -p 'Security.Run API credential: ' SECURITY_RUN_API_KEY
printf '\n'
export SECURITY_RUN_API_KEY

In zsh, use read -r -s 'SECURITY_RUN_API_KEY?Security.Run API credential: ' instead. Set SECURITY_RUN_URL only for a different deployment. .env files are not loaded automatically by either SDK.

Python constructor options:

import os
from security_run import Client

client = Client(
    api_key=os.environ["SECURITY_RUN_API_KEY"],
    base_url="https://www.security.run",
)
client.close()

Node.js constructor options:

import { Client } from '@security-run/sdk';

const client = new Client({
  apiKey: process.env.SECURITY_RUN_API_KEY,
  baseUrl: 'https://www.security.run',
});

Install the JavaScript / TypeScript SDK

Use Node.js 20 or later. From your application directory:

npm install /absolute/path/to/security-run/sdk/javascript

Replace that path with your checkout. The package name is @security-run/sdk; it ships ESM JavaScript and TypeScript declarations. Use .mjs files or set "type": "module" in your project's package.json. Do not assume npm install @security-run/sdk or pip install security-run fetches this release from a public registry; these packages are currently distributed through the repository.

Continue with the CLI guide, Python guide, or JavaScript & TypeScript guide.