diff --git a/examples/python/webhook-file-receiver/.env.example b/examples/python/webhook-file-receiver/.env.example index 89a741f..c7feb8b 100644 --- a/examples/python/webhook-file-receiver/.env.example +++ b/examples/python/webhook-file-receiver/.env.example @@ -7,7 +7,7 @@ DOWNLOAD_DIR=./downloads # mobilerun file API MOBILERUN_BASE_URL=https://api.mobilerun.ai/v1 -MOBILERUN_CLOUD_API_KEY=replace_with_your_api_key +MOBILERUN_API_KEY=replace_with_your_api_key # Optional limits MAX_WEBHOOK_BODY_BYTES=65536 diff --git a/examples/python/webhook-file-receiver/README.md b/examples/python/webhook-file-receiver/README.md index 3980ca9..7ee0bdd 100644 --- a/examples/python/webhook-file-receiver/README.md +++ b/examples/python/webhook-file-receiver/README.md @@ -7,7 +7,8 @@ authentication, and downloads a referenced workflow file through It uses two independent credentials: 1. `WEBHOOK_SECRET` verifies that the exact callback body came from mobilerun. -2. `MOBILERUN_CLOUD_API_KEY` authenticates the referenced file download. +2. `MOBILERUN_API_KEY` authenticates the referenced file download. The older name + `MOBILERUN_CLOUD_API_KEY` is still accepted as a fallback. ## Security behavior @@ -75,7 +76,7 @@ Set these values in `.env`: ```dotenv MOBILERUN_BASE_URL=https://api.mobilerun.ai/v1 -MOBILERUN_CLOUD_API_KEY=dr_sk_... +MOBILERUN_API_KEY=dr_sk_... WEBHOOK_PATH=/mobilerun/a-long-random-private-path WEBHOOK_SECRET=whsec_... DOWNLOAD_DIR=./downloads diff --git a/examples/python/webhook-file-receiver/mobilerun_webhook_receiver/config.py b/examples/python/webhook-file-receiver/mobilerun_webhook_receiver/config.py index 8062619..5cc6159 100644 --- a/examples/python/webhook-file-receiver/mobilerun_webhook_receiver/config.py +++ b/examples/python/webhook-file-receiver/mobilerun_webhook_receiver/config.py @@ -40,7 +40,9 @@ def from_env(cls, env: Mapping[str, str] | None = None) -> Config: values = os.environ if env is None else env webhook_path = values.get("WEBHOOK_PATH", "") secret = values.get("WEBHOOK_SECRET", "") - api_key = values.get("MOBILERUN_CLOUD_API_KEY", "") + api_key = values.get("MOBILERUN_API_KEY") or values.get( + "MOBILERUN_CLOUD_API_KEY", "" + ) api_base_url = values.get( "MOBILERUN_BASE_URL", "https://api.mobilerun.ai/v1" ).rstrip("/") @@ -52,7 +54,7 @@ def from_env(cls, env: Mapping[str, str] | None = None) -> Config: if not secret: raise ConfigurationError("WEBHOOK_SECRET is required") if not api_key: - raise ConfigurationError("MOBILERUN_CLOUD_API_KEY is required") + raise ConfigurationError("MOBILERUN_API_KEY is required") validate_api_base_url(api_base_url) age_seconds = positive_int(values, "MAX_TIMESTAMP_AGE_SECONDS", 300) diff --git a/examples/python/webhook-file-receiver/showcase.py b/examples/python/webhook-file-receiver/showcase.py index e30c1d2..e8625e4 100755 --- a/examples/python/webhook-file-receiver/showcase.py +++ b/examples/python/webhook-file-receiver/showcase.py @@ -92,9 +92,11 @@ def from_env(cls, env: Mapping[str, str] | None = None) -> ShowcaseSettings: if parsed.scheme != "https" or not parsed.netloc: raise ValueError("PUBLIC_URL must be an HTTPS origin") - api_key = values.get("MOBILERUN_CLOUD_API_KEY", "") + api_key = values.get("MOBILERUN_API_KEY") or values.get( + "MOBILERUN_CLOUD_API_KEY", "" + ) if not api_key: - raise ValueError("MOBILERUN_CLOUD_API_KEY is required") + raise ValueError("MOBILERUN_API_KEY is required") trigger_id = values.get("SHOWCASE_TRIGGER_ID") or None if trigger_id: diff --git a/examples/python/webhook-file-receiver/tests/test_showcase.py b/examples/python/webhook-file-receiver/tests/test_showcase.py index 685389b..20f0f1a 100644 --- a/examples/python/webhook-file-receiver/tests/test_showcase.py +++ b/examples/python/webhook-file-receiver/tests/test_showcase.py @@ -55,7 +55,7 @@ def test_requires_complete_reusable_webhook_configuration(self): ShowcaseSettings.from_env( { "PUBLIC_URL": "https://showcase.example", - "MOBILERUN_CLOUD_API_KEY": "dr_sk_test", + "MOBILERUN_API_KEY": "dr_sk_test", "SHOWCASE_WEBHOOK_ID": FILE_ID, } ) @@ -64,7 +64,7 @@ def test_generates_private_access_token(self): result = ShowcaseSettings.from_env( { "PUBLIC_URL": "https://showcase.example", - "MOBILERUN_CLOUD_API_KEY": "dr_sk_test", + "MOBILERUN_API_KEY": "dr_sk_test", } ) diff --git a/examples/typescript/task-runner/.env.example b/examples/typescript/task-runner/.env.example index f065ee1..ad9b54d 100644 --- a/examples/typescript/task-runner/.env.example +++ b/examples/typescript/task-runner/.env.example @@ -1,5 +1,5 @@ # Keep this secret on the server. It is never sent to the browser. -MOBILERUN_CLOUD_API_KEY=dr_sk_... +MOBILERUN_API_KEY=dr_sk_... # Optional; defaults to https://api.mobilerun.ai/v1. # MOBILERUN_API_URL=https://api.mobilerun.ai/v1 diff --git a/examples/typescript/task-runner/README.md b/examples/typescript/task-runner/README.md index 3a46471..970f6cd 100644 --- a/examples/typescript/task-runner/README.md +++ b/examples/typescript/task-runner/README.md @@ -45,9 +45,11 @@ cp .env.example .env Set the server-side key: ```dotenv -MOBILERUN_CLOUD_API_KEY=dr_sk_... +MOBILERUN_API_KEY=dr_sk_... ``` +The older name `MOBILERUN_CLOUD_API_KEY` is still accepted as a fallback. + The example always binds to `127.0.0.1`; it cannot accidentally expose its unauthenticated task and stream-credential routes to the local network. Put an authenticated application or reverse proxy in front of it before making it diff --git a/examples/typescript/task-runner/src/server.ts b/examples/typescript/task-runner/src/server.ts index 3fcb9ad..62db6a6 100644 --- a/examples/typescript/task-runner/src/server.ts +++ b/examples/typescript/task-runner/src/server.ts @@ -22,7 +22,7 @@ const app = createApiApp({ service }); if (!service) { console.warn( - 'MOBILERUN_CLOUD_API_KEY is not set. The UI will load, but tasks cannot start.', + 'MOBILERUN_API_KEY is not set. The UI will load, but tasks cannot start.', ); } diff --git a/examples/typescript/task-runner/src/server/api-app.test.ts b/examples/typescript/task-runner/src/server/api-app.test.ts index ce617e1..4fecad5 100644 --- a/examples/typescript/task-runner/src/server/api-app.test.ts +++ b/examples/typescript/task-runner/src/server/api-app.test.ts @@ -37,7 +37,7 @@ describe('API contracts', () => { expect(response.status).toBe(500); expect(await response.json()).toEqual({ error: 'missing_api_key', - message: 'Set MOBILERUN_CLOUD_API_KEY on the server.', + message: 'Set MOBILERUN_API_KEY on the server.', }); expect(response.headers.get('Cache-Control')).toBe('no-store'); }); diff --git a/examples/typescript/task-runner/src/server/api-app.ts b/examples/typescript/task-runner/src/server/api-app.ts index dab3056..5a06d16 100644 --- a/examples/typescript/task-runner/src/server/api-app.ts +++ b/examples/typescript/task-runner/src/server/api-app.ts @@ -26,7 +26,7 @@ function missingApiKeyResponse(): Response { return jsonResponse( { error: 'missing_api_key', - message: 'Set MOBILERUN_CLOUD_API_KEY on the server.', + message: 'Set MOBILERUN_API_KEY on the server.', }, 500, ); diff --git a/examples/typescript/task-runner/src/server/config.ts b/examples/typescript/task-runner/src/server/config.ts index c2dce00..764cab3 100644 --- a/examples/typescript/task-runner/src/server/config.ts +++ b/examples/typescript/task-runner/src/server/config.ts @@ -22,7 +22,8 @@ export function readServerConfig( environment: Record, ): ServerConfig { return serverConfigSchema.parse({ - apiKey: environment.MOBILERUN_CLOUD_API_KEY, + apiKey: + environment.MOBILERUN_API_KEY || environment.MOBILERUN_CLOUD_API_KEY, apiUrl: normalizeApiBaseUrl(environment.MOBILERUN_API_URL), host: '127.0.0.1', port: environment.PORT ?? 3_000, diff --git a/skills/mobilerun-task-runner/SKILL.md b/skills/mobilerun-task-runner/SKILL.md index 60b52fb..7552520 100644 --- a/skills/mobilerun-task-runner/SKILL.md +++ b/skills/mobilerun-task-runner/SKILL.md @@ -18,7 +18,7 @@ task lifecycle when adapting it. [`package.json`](../../examples/typescript/task-runner/package.json), and [`.env.example`](../../examples/typescript/task-runner/.env.example). 2. Install `@mobilerun/sdk` and `@mobilerun/react` from npm. Do not add local - package overrides. Keep `MOBILERUN_CLOUD_API_KEY` on the server and use + package overrides. Keep `MOBILERUN_API_KEY` on the server and use `MOBILERUN_API_URL` only to override the default API base. 3. Keep SDK calls behind a server adapter. Keep validation and public response schemas independent from SDK response types. @@ -33,7 +33,7 @@ task lifecycle when adapting it. ## Required boundaries -- Never send `MOBILERUN_CLOUD_API_KEY` to the browser or expose raw SDK +- Never send `MOBILERUN_API_KEY` to the browser or expose raw SDK responses through local routes. - Accept only the documented public task fields. Keep model selection, output schema, credentials, and other privileged or expensive SDK options under diff --git a/skills/mobilerun-webhooks/SKILL.md b/skills/mobilerun-webhooks/SKILL.md index 121f642..7b10189 100644 --- a/skills/mobilerun-webhooks/SKILL.md +++ b/skills/mobilerun-webhooks/SKILL.md @@ -22,7 +22,7 @@ the minimal executable entry point. override. 2. Read the receiver's [`README.md`](../../examples/python/webhook-file-receiver/README.md) and [`.env.example`](../../examples/python/webhook-file-receiver/.env.example). - Use `MOBILERUN_CLOUD_API_KEY` and `MOBILERUN_BASE_URL` exactly as shown. + Use `MOBILERUN_API_KEY` and `MOBILERUN_BASE_URL` exactly as shown. 3. Configure a long random `WEBHOOK_PATH` and the endpoint's signing secret in `WEBHOOK_SECRET`. 4. For offline work, run the tests and stop there. Do not create or modify a