Secure Runway SDK and REST Bootstrap

Overview

Establish a reproducible client, explicit API-version contract, and non-billable authentication probe. Runway API keys are organization-scoped credentials, so a working client is not evidence that a user should retain access or that a billable generation is approved.

Prerequisites

• Runway Dev organization and an operator authorized to manage API keys
• Node.js 18+ or Python 3.8+, or an HTTP client for the REST path
• A secret manager and a reviewed X-Runway-Version value

Instructions

Step 1: Discover the integration boundary

Use Read and Grep to locate runtime manifests, lockfiles, existing Runway clients, environment-variable names, and browser/server boundaries. Separate Runway Dev API access from the consumer Runway web application and from the OAuth-based Runway Dev MCP.

Step 2: Resolve and pin the client