Going to production

import os
from skyvern import Skyvern

client = Skyvern(api_key=os.environ["SKYVERN_API_KEY"])

# A task
task = await client.run_task(
    prompt="Get the title of the top post",
    url="https://news.ycombinator.com",
    webhook_url="https://your-server.example.com/skyvern-webhook",
)

# An agent
run = await client.run_workflow(
    workflow_id="wpid_123456789",
    parameters={"invoice_month": "2026-09"},
    webhook_url="https://your-server.example.com/skyvern-webhook",
)

import { Skyvern } from "@skyvern/client";

const client = new Skyvern({ apiKey: process.env.SKYVERN_API_KEY! });

// A task
const task = await client.runTask({
  prompt: "Get the title of the top post",
  url: "https://news.ycombinator.com",
  webhook_url: "https://your-server.example.com/skyvern-webhook",
});

// An agent
const run = await client.runWorkflow({
  agent_id: "wpid_123456789",
  parameters: { invoice_month: "2026-09" },
  webhook_url: "https://your-server.example.com/skyvern-webhook",
});

curl -X POST "https://api.skyvern.com/v1/run/tasks" \
  -H "x-api-key: $SKYVERN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "prompt": "Get the title of the top post",
    "url": "https://news.ycombinator.com",
    "webhook_url": "https://your-server.example.com/skyvern-webhook"
  }'

import hashlib
import hmac
import os

from fastapi import HTTPException, Request

SKYVERN_API_KEY = os.environ["SKYVERN_API_KEY"]


def verify_skyvern_signature(raw_body: bytes, signature: str | None) -> bool:
    if not signature:
        return False
    expected = hmac.new(
        SKYVERN_API_KEY.encode("utf-8"),
        msg=raw_body,
        digestmod=hashlib.sha256,
    ).hexdigest()
    # Compared as bytes: compare_digest raises TypeError on a non-ASCII str,
    # and the signature header is attacker-controlled.
    return hmac.compare_digest(signature.encode("utf-8"), expected.encode("utf-8"))


async def handle_webhook(request: Request):
    raw_body = await request.body()
    signature = request.headers.get("x-skyvern-signature")

    if not verify_skyvern_signature(raw_body, signature):
        raise HTTPException(status_code=401, detail="Invalid signature")

    data = await request.json()
    # Process the request...

import crypto from "crypto";
import express from "express";

function verifySkyvernSignature(rawBody: Buffer, signature: unknown): boolean {
  if (typeof signature !== "string" || signature.length === 0) {
    return false;
  }
  const apiKey = process.env.SKYVERN_API_KEY;
  if (!apiKey) {
    throw new Error("SKYVERN_API_KEY is not set");
  }
  const expected = crypto.createHmac("sha256", apiKey).update(rawBody).digest("hex");
  const received = Buffer.from(signature, "utf8");
  const digest = Buffer.from(expected, "utf8");
  // timingSafeEqual throws unless both buffers are the same length, so compare
  // lengths first and return its result -- never discard it.
  return received.length === digest.length && crypto.timingSafeEqual(received, digest);
}

app.post("/webhook", express.raw({ type: "application/json" }), (req, res) => {
  if (!verifySkyvernSignature(req.body, req.headers["x-skyvern-signature"])) {
    return res.status(401).send("Invalid signature");
  }

  const data = JSON.parse(req.body);
  // Process the request...
  res.status(200).send("OK");
});

package main

import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/hex"
    "io"
    "net/http"
    "os"
)

func verifySkyvernSignature(rawBody []byte, signature string) bool {
    apiKey := os.Getenv("SKYVERN_API_KEY")
    // Without this, an unset key would sign with "" -- a key an attacker also knows.
    if signature == "" || apiKey == "" {
        return false
    }
    mac := hmac.New(sha256.New, []byte(apiKey))
    mac.Write(rawBody)
    expected := hex.EncodeToString(mac.Sum(nil))
    return hmac.Equal([]byte(signature), []byte(expected))
}

func webhookHandler(w http.ResponseWriter, r *http.Request) {
    rawBody, err := io.ReadAll(r.Body)
    if err != nil {
        http.Error(w, "Failed to read request body", http.StatusBadRequest)
        return
    }

    if !verifySkyvernSignature(rawBody, r.Header.Get("x-skyvern-signature")) {
        http.Error(w, "Invalid signature", http.StatusUnauthorized)
        return
    }

    // Process the request...
    w.WriteHeader(http.StatusOK)
}

run = await client.get_run("tsk_v2_490440779503357994")
print(run.status, run.output)

const run = await client.getRun("tsk_v2_490440779503357994");
console.log(run.status, run.output);

curl "https://api.skyvern.com/v1/runs/tsk_v2_490440779503357994" \
  -H "x-api-key: $SKYVERN_API_KEY"

from skyvern.client import RetryRunWebhookRequest

result = await client.retry_run_webhook("tsk_v2_490440779503357994")

# Or to a different URL
result = await client.retry_run_webhook(
    "tsk_v2_490440779503357994",
    request=RetryRunWebhookRequest(webhook_url="https://your-server.example.com/new-hook"),
)
print(result.status_code, result.error)

const result = await client.retryRunWebhook("tsk_v2_490440779503357994");

// Or to a different URL
const redirected = await client.retryRunWebhook("tsk_v2_490440779503357994", {
  webhook_url: "https://your-server.example.com/new-hook",
});
console.log(redirected.status_code, redirected.error);

curl -X POST "https://api.skyvern.com/v1/runs/tsk_v2_490440779503357994/retry_webhook" \
  -H "x-api-key: $SKYVERN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"webhook_url": "https://your-server.example.com/new-hook"}'

run = await client.run_task(
    prompt="Log in and download the invoice for September 2026",
    url="https://vendor-portal.example.com",
    error_code_mapping={
        "login_failed": "The login is rejected, the account is locked, or MFA is required",
        "invoice_not_found": "No invoice exists for the requested month",
        "maintenance": "The site is down for maintenance",
    },
    wait_for_completion=True,
)

codes = [e.get("error_code") for e in (run.errors or [])]
if run.status == "completed":
    save(run.output)
elif "login_failed" in codes:
    alert_owner("vendor-portal login rejected")
elif "maintenance" in codes:
    schedule_retry(minutes=60)
else:
    log_failure(run.run_id, run.failure_reason)

const run = await client.runTask({
  prompt: "Log in and download the invoice for September 2026",
  url: "https://vendor-portal.example.com",
  error_code_mapping: {
    login_failed: "The login is rejected, the account is locked, or MFA is required",
    invoice_not_found: "No invoice exists for the requested month",
    maintenance: "The site is down for maintenance",
  },
  waitForCompletion: true,
});

const codes = (run.errors ?? []).map((e) => e.error_code);
if (run.status === "completed") {
  save(run.output);
} else if (codes.includes("login_failed")) {
  alertOwner("vendor-portal login rejected");
} else if (codes.includes("maintenance")) {
  scheduleRetry(60);
} else {
  logFailure(run.run_id, run.failure_reason);
}

run = await client.run_task(
    prompt="Get the listed price in local currency",
    url="https://shop.example.co.uk/product/123",
    proxy_location="RESIDENTIAL_GB",
)

# State or city level
run = await client.run_task(
    prompt="Get the local delivery estimate",
    url="https://shop.example.com/product/123",
    proxy_location={"country": "US", "subdivision": "CA", "city": "San Francisco"},
)

const run = await client.runTask({
  prompt: "Get the listed price in local currency",
  url: "https://shop.example.co.uk/product/123",
  proxy_location: "RESIDENTIAL_GB",
});

// State or city level
const local = await client.runTask({
  prompt: "Get the local delivery estimate",
  url: "https://shop.example.com/product/123",
  proxy_location: { country: "US", subdivision: "CA", city: "San Francisco" },
});

run = await client.run_workflow(
    workflow_id="wpid_123456789",
    max_steps_override=30,
    max_elapsed_time_minutes=30,
    run_with="code",
)

const run = await client.runWorkflow({
  agent_id: "wpid_123456789",
  "x-max-steps-override": 30,
  max_elapsed_time_minutes: 30,
  run_with: "code",
});