feat(examples): read MOBILERUN_API_KEY first

examples/python/webhook-file-receiver/.env.example

@@ -7,7 +7,7 @@ DOWNLOAD_DIR=./downloads
 
 # mobilerun file API
 MOBILERUN_BASE_URL=https://api.mobilerun.ai/v1
-MOBILERUN_CLOUD_API_KEY=replace_with_your_api_key
+MOBILERUN_API_KEY=replace_with_your_api_key
 
 # Optional limits
 MAX_WEBHOOK_BODY_BYTES=65536

examples/python/webhook-file-receiver/README.md

@@ -7,7 +7,8 @@ authentication, and downloads a referenced workflow file through
 It uses two independent credentials:
 
 1. `WEBHOOK_SECRET` verifies that the exact callback body came from mobilerun.
-2. `MOBILERUN_CLOUD_API_KEY` authenticates the referenced file download.
+2. `MOBILERUN_API_KEY` authenticates the referenced file download. The older name
+   `MOBILERUN_CLOUD_API_KEY` is still accepted as a fallback.
 
 ## Security behavior
 
@@ -75,7 +76,7 @@ Set these values in `.env`:
 
 ```dotenv
 MOBILERUN_BASE_URL=https://api.mobilerun.ai/v1
-MOBILERUN_CLOUD_API_KEY=dr_sk_...
+MOBILERUN_API_KEY=dr_sk_...
 WEBHOOK_PATH=/mobilerun/a-long-random-private-path
 WEBHOOK_SECRET=whsec_...
 DOWNLOAD_DIR=./downloads

examples/python/webhook-file-receiver/mobilerun_webhook_receiver/config.py

@@ -40,7 +40,9 @@ def from_env(cls, env: Mapping[str, str] | None = None) -> Config:
         values = os.environ if env is None else env
         webhook_path = values.get("WEBHOOK_PATH", "")
         secret = values.get("WEBHOOK_SECRET", "")
-        api_key = values.get("MOBILERUN_CLOUD_API_KEY", "")
+        api_key = values.get("MOBILERUN_API_KEY") or values.get(
+            "MOBILERUN_CLOUD_API_KEY", ""
+        )
         api_base_url = values.get(
             "MOBILERUN_BASE_URL", "https://api.mobilerun.ai/v1"
         ).rstrip("/")
@@ -52,7 +54,7 @@ def from_env(cls, env: Mapping[str, str] | None = None) -> Config:
         if not secret:
             raise ConfigurationError("WEBHOOK_SECRET is required")
         if not api_key:
-            raise ConfigurationError("MOBILERUN_CLOUD_API_KEY is required")
+            raise ConfigurationError("MOBILERUN_API_KEY is required")
         validate_api_base_url(api_base_url)
 
         age_seconds = positive_int(values, "MAX_TIMESTAMP_AGE_SECONDS", 300)

examples/python/webhook-file-receiver/showcase.py

@@ -92,9 +92,11 @@ def from_env(cls, env: Mapping[str, str] | None = None) -> ShowcaseSettings:
         if parsed.scheme != "https" or not parsed.netloc:
             raise ValueError("PUBLIC_URL must be an HTTPS origin")
 
-        api_key = values.get("MOBILERUN_CLOUD_API_KEY", "")
+        api_key = values.get("MOBILERUN_API_KEY") or values.get(
+            "MOBILERUN_CLOUD_API_KEY", ""
+        )
         if not api_key:
-            raise ValueError("MOBILERUN_CLOUD_API_KEY is required")
+            raise ValueError("MOBILERUN_API_KEY is required")
 
         trigger_id = values.get("SHOWCASE_TRIGGER_ID") or None
         if trigger_id:

examples/python/webhook-file-receiver/tests/test_showcase.py

@@ -55,7 +55,7 @@ def test_requires_complete_reusable_webhook_configuration(self):
             ShowcaseSettings.from_env(
                 {
                     "PUBLIC_URL": "https://showcase.example",
-                    "MOBILERUN_CLOUD_API_KEY": "dr_sk_test",
+                    "MOBILERUN_API_KEY": "dr_sk_test",
                     "SHOWCASE_WEBHOOK_ID": FILE_ID,
                 }
             )
@@ -64,7 +64,7 @@ def test_generates_private_access_token(self):
         result = ShowcaseSettings.from_env(
             {
                 "PUBLIC_URL": "https://showcase.example",
-                "MOBILERUN_CLOUD_API_KEY": "dr_sk_test",
+                "MOBILERUN_API_KEY": "dr_sk_test",
             }
         )
 

examples/typescript/task-runner/.env.example

@@ -1,5 +1,5 @@
 # Keep this secret on the server. It is never sent to the browser.
-MOBILERUN_CLOUD_API_KEY=dr_sk_...
+MOBILERUN_API_KEY=dr_sk_...
 
 # Optional; defaults to https://api.mobilerun.ai/v1.
 # MOBILERUN_API_URL=https://api.mobilerun.ai/v1

examples/typescript/task-runner/README.md

@@ -45,9 +45,11 @@ cp .env.example .env
 Set the server-side key:
 
 ```dotenv
-MOBILERUN_CLOUD_API_KEY=dr_sk_...
+MOBILERUN_API_KEY=dr_sk_...
 ```
 
+The older name `MOBILERUN_CLOUD_API_KEY` is still accepted as a fallback.
+
 The example always binds to `127.0.0.1`; it cannot accidentally expose its
 unauthenticated task and stream-credential routes to the local network. Put an
 authenticated application or reverse proxy in front of it before making it

examples/typescript/task-runner/src/server.ts

@@ -22,7 +22,7 @@ const app = createApiApp({ service });
 
 if (!service) {
   console.warn(
-    'MOBILERUN_CLOUD_API_KEY is not set. The UI will load, but tasks cannot start.',
+    'MOBILERUN_API_KEY is not set. The UI will load, but tasks cannot start.',
   );
 }
 

examples/typescript/task-runner/src/server/api-app.test.ts

@@ -37,7 +37,7 @@ describe('API contracts', () => {
     expect(response.status).toBe(500);
     expect(await response.json()).toEqual({
       error: 'missing_api_key',
-      message: 'Set MOBILERUN_CLOUD_API_KEY on the server.',
+      message: 'Set MOBILERUN_API_KEY on the server.',
     });
     expect(response.headers.get('Cache-Control')).toBe('no-store');
   });

examples/typescript/task-runner/src/server/api-app.ts

@@ -26,7 +26,7 @@ function missingApiKeyResponse(): Response {
   return jsonResponse(
     {
       error: 'missing_api_key',
-      message: 'Set MOBILERUN_CLOUD_API_KEY on the server.',
+      message: 'Set MOBILERUN_API_KEY on the server.',
     },
     500,
   );

examples/typescript/task-runner/src/server/config.ts

@@ -22,7 +22,8 @@ export function readServerConfig(
   environment: Record<string, string | undefined>,
 ): ServerConfig {
   return serverConfigSchema.parse({
-    apiKey: environment.MOBILERUN_CLOUD_API_KEY,
+    apiKey:
+      environment.MOBILERUN_API_KEY || environment.MOBILERUN_CLOUD_API_KEY,
     apiUrl: normalizeApiBaseUrl(environment.MOBILERUN_API_URL),
     host: '127.0.0.1',
     port: environment.PORT ?? 3_000,

skills/mobilerun-task-runner/SKILL.md

@@ -18,7 +18,7 @@ task lifecycle when adapting it.
    [`package.json`](../../examples/typescript/task-runner/package.json), and
    [`.env.example`](../../examples/typescript/task-runner/.env.example).
 2. Install `@mobilerun/sdk` and `@mobilerun/react` from npm. Do not add local
-   package overrides. Keep `MOBILERUN_CLOUD_API_KEY` on the server and use
+   package overrides. Keep `MOBILERUN_API_KEY` on the server and use
    `MOBILERUN_API_URL` only to override the default API base.
 3. Keep SDK calls behind a server adapter. Keep validation and public response
    schemas independent from SDK response types.
@@ -33,7 +33,7 @@ task lifecycle when adapting it.
 
 ## Required boundaries
 
-- Never send `MOBILERUN_CLOUD_API_KEY` to the browser or expose raw SDK
+- Never send `MOBILERUN_API_KEY` to the browser or expose raw SDK
   responses through local routes.
 - Accept only the documented public task fields. Keep model selection, output
   schema, credentials, and other privileged or expensive SDK options under

skills/mobilerun-webhooks/SKILL.md

@@ -22,7 +22,7 @@ the minimal executable entry point.
    override.
 2. Read the receiver's [`README.md`](../../examples/python/webhook-file-receiver/README.md)
    and [`.env.example`](../../examples/python/webhook-file-receiver/.env.example).
-   Use `MOBILERUN_CLOUD_API_KEY` and `MOBILERUN_BASE_URL` exactly as shown.
+   Use `MOBILERUN_API_KEY` and `MOBILERUN_BASE_URL` exactly as shown.
 3. Configure a long random `WEBHOOK_PATH` and the endpoint's signing secret in
    `WEBHOOK_SECRET`.
 4. For offline work, run the tests and stop there. Do not create or modify a