Private Scripts
Private scripts require a fetch token on the raw endpoint. A login cookie is not enough.
Header
Send the fetch token as a bearer credential. A Runny login cookie does not authorize /r/{slug}.
curl -fsSL -H "Authorization: Bearer TOKEN" https://runny.sh/r/{slug} | bash?token= works on the raw path for compatibility. Prefer the header so the secret stays out of access logs, Referer, and shell history.
Denied fetches
Missing or invalid tokens return HTTP 200 with header X-Runny-Status: denied and a stub in the script’s runtime. curl -fsSL still prints the message. The original body is not sent.