Sign In Get Started

Runny.sh docs

Documentation

Runny.sh hosts scripts and serves the exact bytes over HTTPS. We never execute your code.

01

The one-liner contract

Every script has a stable raw endpoint. Fetch it from a shell, pipe it to the runtime you reviewed, and keep your deployment path simple.

curl -fsSL https://runny.sh/r/{slug} | bash
curl -fsSL https://runny.sh/r/{slug} | python3
curl -fsSL https://runny.sh/r/{slug} | pwsh
curl -fsSL https://runny.sh/r/{slug} | node

/r/{slug} always returns text/plain; charset=utf-8 with X-Content-Type-Options: nosniff, Cache-Control: private, no-store, and a restrictive Content-Security-Policy. It never sets a session cookie. Public scripts are scanned on save and rate-limited on fetch.

02

Private scripts

Private scripts require a fetch token, not a login session. Send it as an authorization header so the token does not land in access logs, Referer headers, or shell history as a URL.

curl -fsSL -H "Authorization: Bearer TOKEN" https://runny.sh/r/{slug} | bash

03

API

Pro accounts can mint API tokens in Settings. Send them as Authorization: Bearer rny_…. The API does not use session cookies or CSRF tokens.

curl -fsSL -H "Authorization: Bearer rny_…" https://runny.sh/api/v1/scripts
curl -fsSL -X POST -H "Authorization: Bearer rny_…" \
  -H "Content-Type: application/json" \
  -d '{"title":"setup","runtime":"bash","visibility":"public","expiry":"1d","body":"echo hi\n"}' \
  https://runny.sh/api/v1/scripts
curl -fsSL -X PATCH -H "Authorization: Bearer rny_…" \
  -H "Content-Type: application/json" \
  -d '{"title":"setup","body":"echo ready\n"}' \
  https://runny.sh/api/v1/scripts/{slug}
curl -fsSL -X DELETE -H "Authorization: Bearer rny_…" \
  https://runny.sh/api/v1/scripts/{slug}
  • ListGET /api/v1/scripts
  • CreatePOST /api/v1/scripts — JSON body with title, runtime, visibility, expiry, and body.
  • ReadGET /api/v1/scripts/{slug}
  • UpdatePATCH /api/v1/scripts/{slug}
  • ArchiveDELETE /api/v1/scripts/{slug}

04

Pricing

New accounts start on Free. Subscribe to Pro from Settings when Stripe is configured. Operators can still grant complimentary Pro and seats from Ops.

  • Free10 public scripts, 100 executions per day (3,000 / month), 24-hour expiry, 256 KB max. Expired scripts can be renewed. Documentation only.
  • Pro$12/month. Unlimited scripts and executions, private and unlisted scripts, custom expiry, analytics, teams, and API access. Pay yourself or join a team seat.
  • Team seats$12/seat/month. A seat grants personal Pro while the member stays on the team. Collaborators who pay their own bill do not use a seat. Adopt moves an existing self-paid Pro onto the team bill; personal scripts stay personal.

05

Support

Product help is these docs. Report harmful scripts at /abuse or abuse@runny.sh.

Human support is for Enterprise accounts. Write enterprise@runny.sh.

Account mail — welcome, team invites, password resets, MFA changes, share notices, and report receipts — is branded HTML with a plaintext alternative. Reset a password from /forgot.

06

Authenticator

Every account can enable a TOTP authenticator from Settings. After your password, sign-in asks for a six-digit code or a one-time recovery code. Secrets are encrypted at rest. Recovery codes are stored as hashes and shown once.

We never execute your scripts. MFA protects the account that hosts them.

07

Lifecycle

  • Unguessable slugsEvery script receives a random 12-character slug.
  • First-fetch expiryAtomic limits prevent two curls from succeeding when max_fetches = 1.
  • Time-to-liveAfter expires_at, the raw URL returns 410. Free scripts expire after 24 hours and can be renewed from the script page.
  • Revoke anytimeRevoke from the share page and raw fetches stop immediately.

08

Terms (short)

You are responsible for what you host. Piping remote scripts to a shell is dangerous. Review the preview page before you run anything. We may remove abuse, malware, or illegal content.

09

Privacy

We store hashed IPs and user-agents on fetches, not raw addresses. Script bodies live in a separate table from listing metadata. Authenticator secrets are encrypted with the application key.

10

Report a script

Use /abuse — no account required — or email abuse@runny.sh with the URL or slug and why it should come down.

Restore revision