# Set up access and retries



Authenticate your client and retry a request without creating a second run.

 

## 1. Set your endpoint and credential



Set `SECURITY_RUN_URL` to your deployment’s API URL, not `security.run`. Store your token in `SECURITY_RUN_API_KEY`. The token identifies your owner scope; keep it out of source control and URLs.

 

## 2. Test access



Run the example. A successful response contains a `tools` list. If the response is `401`, check that you used the correct URL and token before submitting a run.

 

## 3. Keep the key when retrying



Create one `Idempotency-Key` for each intended operation and save it alongside your request body. If a response is lost, resend the same body with the same key. Do not generate a new key just because a network request failed.

 

A different body with the same key returns `409`. Use a new key only when you mean to create a new operation. Keys must be no longer than 128 characters.

 

## Using a deployment you operate



The preview accepts owner-scoped tokens configured by the operator. See [Deploy in your AWS account](https://www.security.run/docs/customer-cloud.html) to configure them. Organization authentication and retention policies are not part of this preview.

## Test the credential

```bash
curl --fail-with-body "$SECURITY_RUN_URL/v1/tools?limit=20" \
  -H "Authorization: Bearer $SECURITY_RUN_API_KEY"
```