npm

@scalar/api-client

3.17.0scalar/scalar ↗

the open source API testing client

Last release 2 days ago
28 Aug 2026
Ships on a steady schedule
a new release about every 1 weeks
Nearly every release is documented
notes for 54 of the last 60 stable releases
Nothing withdrawn
no release was ever pulled
3 years old
554 releases · first in 2023

Release timeline

554 releases since 2023

2023202420252026

20232026

One column per quarter.

Releases

3.17.028 Aug 2026
Release notes
Minor Changes
- feat: test OpenAPI webhooks from the API reference and API client
Patch Changes
- #9983: Bump the zod catalog to ^4.4.3 so the standalone bundle ships a single zod instead of two (4.3.5 from @scalar/types plus 4.4.3 from the ai / @ai-sdk peer). This makes standalone.js ~68KB raw / ~18KB gzip smaller.
- #10024: Fix "Test Request" discarding an edited request body when the operation it opens is already the one on screen. Reopening the entry the modal already shows does not route anywhere, so the request body kept its edited value while the composition selection was replaced with whatever the reference page had selected. The request body read that as a manual oneOf/anyOf branch switch and regenerated itself from the schema. An open modal now keeps the selection it is already showing, while opening a different entry still re-establishes it.
Open source →
3.16.320 Aug 2026
Release notes
Patch Changes
- #9941: Republish every package through npm trusted publishing. No functional changes.
Open source →
3.16.113 Aug 2026
Nothing published for this version
3.16.013 Aug 2026
Release notes
Minor Changes
- #9868: Control OAuth2 flow tabs from your OpenAPI document. Add x-order to a flow to set the order of the tabs in the auth section (the first tab is selected by default, so the lowest x-order also becomes the default flow), and add x-scalar-ignore to a flow to hide its tab — useful for flows that cannot run in the browser, like Client Credentials, which usually fails on CORS. x-scalar-ignore on a whole security scheme now hides it from the auth selector too.
Patch Changes
- #9869: Show NDJSON responses instead of "Binary file". Responses with application/x-ndjson or application/ndjson are now rendered as text, with each JSON record pretty-printed in the preview.
- #9780: Make environment variables work in pre-request and post-response scripts. pm.environment.get() (and pm.variables.get()) now read the active environment, and pm.environment.set() / pm.environment.unset() persist back to it so values like a bearer token survive to the next request. Previously the script variable store was created empty per request and discarded afterwards, so scripted reads returned undefined and writes were lost even though {{variable}} placeholders resolved correctly.
Open source →
3.15.07 Aug 2026
Release notes
Minor Changes
- #9836: Add a preset switcher for global cookies that share a name. Instead of rendering one row per value (where toggling one toggled them all), same-named x-scalar-cookies now collapse into a single row with a dropdown to switch between the predefined values — for example a Culture cookie with PL and EN. Only the selected value is sent, and the choice persists.
Patch Changes
- #9793: Expose server and customFetch in the ClientPlugin beforeRequest hook payload (both optional, additive) so plugins can resolve relative URLs and run network calls — e.g. a token refresh — through the host fetch without closing over external state.
- #9828: Bump shared build and runtime dependencies to their latest compatible versions (fuse.js, vite, vitest, tailwindcss, @vitejs/plugin-vue, @vue/test-utils, posthog-js, yaml, and the CSS injection plugin). The fuse.js 7.5.0 upgrade tightened generic inference, so the empty new Fuse([]) search instances now pass an explicit FuseData type argument.
- #9798: fix: header parameters with x-disabled: false (e.g. x-scenario-id) now stay enabled while editing
  
  RequestTableRow's handleUpdateRow unconditionally ran isDisabled.value = payload.isDisabled ?? false. When CodeInputLite fired @update:modelValue for the name or value field it called handleUpdateRow({ name: v }) with no isDisabled, which reset the row to enabled on every keystroke and overrode the correct initial state read from x-disabled. It now only updates isDisabled when it is explicitly present in the payload.
- #9804: Long file names in the multipart form no longer stretch the request table past its container. The name now truncates with an ellipsis, and hovering shows the full name.
Open source →
3.14.031 Jul 2026
Release notes
Minor Changes
- #9709: Add an OAuth2 token-acquisition shortcut to HTTP bearer schemes, so a bearer token can be obtained through an OAuth2 flow without switching auth methods.
  - The bearer scheme's form gains an inline Authorize via OAuth2 shortcut (and, for authorization-code, Refresh) that runs the flow and writes the resulting access token onto the bearer scheme — so the panel never switches to oauth2 and the request sends Authorization: Bearer. A gear opens the oauth2 configuration in a modal (OAuth2.hideActions).
  - A new getOauth2AcquisitionTarget helper finds the oauth2 flow the shortcut uses, preferring the authorization-code grant (which can refresh) over implicit. Every defined security scheme, oauth2 included, stays selectable in the auth dropdown — the shortcut is purely additive.
  - runOAuth2Authorize + storeOAuth2Tokens route the access token to the bearer scheme and the refresh token to the oauth2 scheme.
- #9726: feat: add a switchable form view for JSON and YAML request bodies
  
  When a request body's content type is JSON or YAML and its schema (or the current example) describes an object, a "Form / Raw" toggle now appears next to the content type selector. The form view renders one row per schema property — with enum dropdowns, required badges, defaults, and per-field validation, matching the existing multipart/form-data editor — and folds edits back into a nested object using the schema's declared types (numbers, booleans, arrays, and nested objects survive the round-trip instead of becoming strings). The raw code editor remains the default and is unaffected for non-object bodies or unparseable text.
  
  @scalar/workspace-store gains reusable exports for this: buildDottedNestedRowPredicate, coerceLeafValueToSchemaType, coerceUntypedValue, and resolveLeafSchema from @scalar/workspace-store/request-example, factored out of the existing multipart request-body builder.
Patch Changes
- #9697: Add credential input UIs for the AsyncAPI broker-specific security scheme types, which previously showed a "not supported yet" message in the Authentication selector. The SASL-style schemes (userPassword, plain, scramSha256, scramSha512) get a username + password form like HTTP basic, X509 gets client certificate + private key (PEM) inputs, symmetricEncryption/asymmetricEncryption get a single key input, and gssapi gets a service name input. The entered credentials are persisted in the auth store with new type-specific secret shapes (x-scalar-secret-client-certificate, x-scalar-secret-private-key, x-scalar-secret-service-name, plus the existing username/password/token extensions) and round-trip through the merged scheme objects the same way as the OpenAPI types. The Galaxy AsyncAPI sample document now defines one scheme of each broker group so the inputs can be exercised.
- #9723: Fix missing accessible names on request/scopes table checkboxes and their row delete buttons. DataTableCheckbox now accepts an ariaLabel prop, and RequestTableRow/OAuthScopesInput pass row-specific labels (e.g. "Include x-api-key in request", "Select read:users scope") so screen reader users can tell which row a control acts on.
- #9595: Clicking an OAuth2 scope checkbox no longer toggles the scope twice. The click no longer bubbles to the surrounding row, which had its own toggle handler.
- #9594: Fix OAuth2 scope checkboxes losing selections on quick clicks. Each scope is now toggled against the stored selection instead of a list computed in the component, so the "Scopes Selected" counter and the scopes sent to the token endpoint stay in sync with the checkboxes.
- #9773: Allow using a client secret together with PKCE in the OAuth authorization code flow, so confidential clients can use both (as recommended by RFC 9700).
Open source →
3.13.716 Jul 2026
Release notes
Patch Changes
- #9719: docs: update the Scalar platform overview block in the README
Open source →
3.13.616 Jul 2026
Release notes
Patch Changes
- #9687: feat(themes): derive the border radius scale from --scalar-radius
  
  The radius tokens used to be independent, so setting --scalar-radius: 0 still left rounded corners behind on anything using --scalar-radius-lg, --scalar-radius-xl or rounded-full. They now all derive from --scalar-radius, which means overriding that single variable rescales every corner in the interface, and 0 squares it off completely.
  
  Two new tokens fill out the scale, --scalar-radius-2xl (12px) and --scalar-radius-3xl (16px), along with --scalar-radius-full for pills and circles. The matching rounded-2xl and rounded-3xl Tailwind utilities now emit CSS; previously they were silently dropped.
  
  Every default value is unchanged, so nothing shifts unless you were relying on the old behaviour. If your theme sets --scalar-radius on its own and expects the larger radii to stay put, set those tokens explicitly. Override --scalar-radius on :root: a custom property substitutes var() at the element where it is declared, so setting the base further down the tree moves it without moving anything derived from it.
Open source →
3.13.515 Jul 2026
Nothing published for this version
3.13.415 Jul 2026
Release notes
Patch Changes
- #9618: Name the actual document type in the "security scheme is missing a type" warning. When a scheme has no recognizable type, the auth selector previously always told users to check their "OpenAPI document", even for AsyncAPI documents. The warning now reflects the document it belongs to (e.g. "AsyncAPI") via a new optional documentType prop on the auth selector block, defaulting to openapi. Schemes that carry a valid but unsupported type (such as AsyncAPI broker types like userPassword or scramSha256) now show a dedicated "not supported yet" message naming the type, instead of the misleading "missing a type" warning.
Open source →
3.13.38 Jul 2026
Release notes
Patch Changes
- #9671: Add a canDeleteSchemes prop to the auth selector so the delete (trash) affordance can be hidden. It defaults to true (unchanged for the API client, where schemes are editable) and the API reference now passes false, since its schemes come from the rendered document and cannot be removed there.
- #9670: Persist cookies set by a response into the document cookie jar so values like a Django CSRF token survive a page reload and are replayed on later requests
Open source →
3.13.23 Jul 2026
Nothing published for this version
3.13.12 Jul 2026
Nothing published for this version
3.13.030 Jun 2026
Release notes
Minor Changes
- #9613: feat(api-client): support an injectable OAuth2 redirect capture for interactive flows
  
  Adds an optional captureOAuth2Callback option so environments that cannot use browser-popup polling (notably the Electron desktop app, where the renderer runs on file://) can run the authorization-code and implicit flows through the system browser and a host-owned redirect target. The desktop app uses this to capture the redirect on a 127.0.0.1 loopback server (RFC 8252).
Patch Changes
- #9592: fix: only offer the security schemes an operation actually declares
  
  The auth dropdown no longer lists every scheme from components.securitySchemes. In the reference docs and the request modal it now respects the operation's security: an operation with security: [] offers no auth, and an operation that lists a subset of schemes only offers those. The standalone client keeps letting you attach any defined scheme.
Open source →
3.12.026 Jun 2026
Release notes
Minor Changes
- #8519: refactor: extract the code example block into @scalar/blocks/code-example. api-client, api-client-react, and api-reference now import CodeExample, findClient, generateClientOptions, and the related helpers from the new package. workspace-store exports isParamDisabled with an optional defaultDisabled argument.
  
  Breaking (@scalar/api-client): the @scalar/api-client/blocks/operation-code-sample and @scalar/api-client/v2/blocks/operation-code-sample export paths have been removed. Import from @scalar/blocks/code-example instead, and use the renamed CodeExample / CodeExampleProps (previously OperationCodeSample / OperationCodeSampleProps).
Patch Changes
- #9584: Show the trailing-bracket name (filter[ids][]) on expanded deepObject array parameter rows so the table matches the serialized request, and keep edited array leaves as arrays when writing the value back
- #9548: Keep request and response example pickers in sync across operations. Selecting an example (e.g. "Use case 1") now selects the example with the same key on every other operation that defines it, mirroring how the programming-language selection already syncs. Operations that do not have a matching example keep their current selection.
Open source →
3.11.022 Jun 2026
Release notes
Minor Changes
- #9515: feat: add requestBuilt client plugin hook and onRequestBuilt configuration callback that receive the exact fetch Request that is sent over the wire
  
  The hook runs after the request has been built, right before it is sent. Header mutations apply to the outgoing request and the body bytes match what the server receives, which makes request signing possible: hashing the body of a rebuilt multipart/form-data request would produce a different multipart boundary than the request that is actually sent.
Patch Changes
- #9558: Fix the request runner dropping a manually typed auth token when the document name is not slug-safe (e.g. documents loaded via sources). The modal now reads auth secrets under the same document key they are written to.
- #9497: Fix renaming an auto-expanded query parameter row: the committed key is applied to the request and persists in the table without writing partial in-progress edits, and the original key no longer reappears as an empty suggestion
Open source →
3.10.417 Jun 2026
Release notes
Patch Changes
- #9319: feat: route OAuth2 token exchange/refresh and OpenID Connect discovery through the configured customFetch
  
  The auth selector now forwards the client's customFetch to the OAuth2 and OpenID Connect flows. This lets the Electron desktop app pipe these requests over IPC (like regular API requests) instead of the renderer's network stack, so the desktop Content Security Policy can lock down connect-src. When no customFetch is provided the flows fall back to the global fetch, so web behavior is unchanged.
- #9138: feat(api-client): add CodeInputLite, a lightweight contenteditable variable input that replaces CodeMirror in the request, auth, and environment tables for better performance
Open source →
3.10.311 Jun 2026
Release notes
Patch Changes
- #9482: Fix the auth scheme dropdown not opening when multiple client apps are on the page (for example, the API reference modal). Each modal app now gets a unique id prefix, so teleport targets no longer collide and the popover renders in the visible app instead of a hidden one
- #9342: fix: resolve operations when OpenAPI path items use $ref
  
  Path entries and webhooks can reference components.pathItems instead of inlining operations. Navigation, mutators, search, and markdown export now resolve path-item references before reading HTTP methods and path-level parameters.
- #9498: Sync the SDK installation tabs with the operation code examples: picking a language under "Client Libraries" now switches every operation's code sample to that language's custom example
Open source →
3.10.29 Jun 2026
Nothing published for this version
3.10.19 Jun 2026
Release notes
Patch Changes
- #9449: Replace the CommonJS-only cookie dependency with an in-repo ESM serializeCookie helper
Open source →
3.10.08 Jun 2026
Release notes
Minor Changes
- #9398: feat: read code samples from x-readme, x-stainless and x-scalar extensions
  
  In addition to x-codeSamples, the code sample picker now reads custom samples from x-scalar-examples, x-stainless-snippets, x-stainless-examples, and x-readme.code-samples. When more than one is present on an operation, the highest-priority source is used (x-scalar-examples > x-stainless-snippets > x-stainless-examples > x-readme > x-codeSamples).
Patch Changes
- #9438: feat(api-reference): add an AsyncAPI server selector
  
  Adds a server selector for AsyncAPI documents in the API reference introduction. It mirrors the OpenAPI server selector but works with the AsyncAPI server shape (a named map of host/protocol/pathname), labelling each server with its constructed connection URL.
  
  Server selection and variable changes are now persisted to the workspace store via new asyncapi-server:update:selected and asyncapi-server:update:variables events and their mutators, mirroring the OpenAPI wiring.
- #9404: Send multipart/form-data and application/x-www-form-urlencoded object properties using their OpenAPI encoding style/explode (for example style: deepObject produces address[city]=... bracket notation) instead of always JSON-stringifying them. The request sent over the wire now matches the generated code snippet.
- #9408: Render the client library name as a plain label instead of a dropdown when only a single client is available
Open source →
3.9.02 Jun 2026
Release notes
Minor Changes
- #9341: feat: add WebSocket session transport and plugin hooks for AsyncAPI
  
  Add WebSocketSession with connect, send, and close helpers, plus connectWebSocket orchestration using Result-based errors. Extend ClientPlugin with optional webSocketHooks (beforeConnect, onWebSocketMessage, onWebSocketClose).
Patch Changes
- #9310: Add an ESM standalone build (dist/browser/standalone.esm.js) alongside the existing UMD bundle. The new bundle works as a side-effect script (registers window.Scalar.createApiReference and reads data-* configuration) and exports createApiReference for direct ESM consumers. It is fully minified through Rolldown's native minifier and uses code splitting so heavy features load asynchronously after first paint:
  - The API client modal (request editor, response viewer, CodeMirror) is now await import'd inside onMounted instead of statically imported, moving ~265 KB into a chunks/modal-*.js chunk that loads in the background.
  - The Agent Scalar chat interface (already wrapped in defineAsyncComponent) becomes a real chunks/AgentScalarChatInterface-*.js chunk (~200 KB), loaded only when the agent is enabled.
  - The 84 per-icon dynamic imports from @scalar/icons/library are coalesced into a single chunks/icons-*.js.
  Net effect: initial sync load drops from ~3.32 MB (UMD) to ~2.73 MB (ESM) — a ~570 KB improvement — while total bundle size shrinks by ~140 KB.
  
  Also adds an @scalar/api-client/modal/map-hidden-clients-config deep export so consumers that only need the lightweight client-list helper don't pull the full modal barrel into their static graph.
- #9323: Fixed x-codeSamples entries that share a lang: multiple code samples with the same language but different labels (e.g. separate sync and async examples) were all marked selected and showed the same snippet. Each sample is now keyed by its position, so every one stays individually selectable.
- #9338: perf: warm up the request scripts sandbox on mount when scripts are present, so the first request no longer pays the sandbox cold-start cost
Open source →
3.8.522 May 2026
Release notes
Patch Changes
- #9334: Add analytics events for document save and registry sync (pull/push) actions
Open source →
3.8.422 May 2026
Nothing published for this version
3.8.321 May 2026
Release notes
Patch Changes
- #9145: fix(api-client): ignore encoding.contentType on application/x-www-form-urlencoded request bodies
  
  Per OAS 3.1.x Encoding Object, contentType SHALL be ignored when the request body media type is not a multipart. After the recent change that lifted the multipart gate on encoding.style/explode/allowReserved, the encoding map started being passed for urlencoded bodies too. As a side effect, a urlencoded encoding entry that only set contentType would JSON-stringify object values into a single part instead of keeping the spec-default dotted-key flattening. Suppress contentType for non-multipart bodies so the flattening branch is restored.
- #9145: fix(api-client): encode nested object properties in multipart/form-data as a single JSON part instead of flattening them with dotted keys
- #9145: fix(api-client): serialize multipart/form-data and application/x-www-form-urlencoded parts with form / spaceDelimited / pipeDelimited / deepObject styles per RFC6570 when encoding.style / explode / allowReserved is set, matching how query parameters are already serialized. Replaces the dotted-key flattening previously emitted for style: form, explode: true.
- #9145: fix(api-client): JSON-stringify nested object/array values under style: form instead of emitting [object Object] in multipart/form-data and application/x-www-form-urlencoded bodies. RFC 6570 form-style serialization only addresses one level of nesting and OpenAPI 3.1 leaves deeper structures undefined; readable JSON is more useful than String(value) garble. The documented escape hatch for cleaner output remains style: deepObject with explode: true.
- #9155: feat(api-client): expand nested object properties of multipart form-data schemas into individual editable rows (e.g. props.name, props.description); the wire still sends one application/json multipart part per top-level object property — both for the initial schema-derived example and for edited form rows
- #9248: feat: open the API client on the selected operation when launching from API Reference. The modal "Open API Client" link now includes operation_path and operation_method query params; scalar-app reads them after import and navigates to that request. Also fixes address bar blur replay when focus moves programmatically on first navigation into a draft operation.
- #9259: fix(api-client): harden response body preview against XSS and referrer leakage
  
  The response body preview now validates src against an allow-list of safe protocols (blob:, http:, https:, and data: URIs limited to known media types) before rendering, replaces the <object> fallback with a fully sandboxed <iframe> (sandbox=""), and sets referrerpolicy="no-referrer" on all media elements so untrusted response URLs cannot execute script in the app origin or leak the user's location to third-party hosts.
Open source →
3.8.216 May 2026
Release notes
Patch Changes
- #9236: fix: some analytics events not firing
Open source →
3.8.114 May 2026
Release notes
Patch Changes
- #9216: chore: bumping release
- #9218: chore: bump
Open source →
3.8.014 May 2026
Release notes
Minor Changes
- #9211: feat: make WorkspaceDocument an union of OpenApiDocument and AsyncApiDocument
- #9211: feat: let the command palette pick a registry document version
Patch Changes
- #9211: feat: add Cmd/Ctrl+S for ui:save:local-document so hosts (e.g. scalar-app) can match the header Save control for local workspaces
- #9211: fix(api-client): block invalid request URLs before send and surface buildRequest failures as results
  
  Request construction now treats a bad merged URL as a first-class failure instead of throwing deep inside helpers. After mergeUrls, resolveRequestFactoryUrl rejects incomplete targets when strict mode applies: relative URLs, an empty server base, or path strings that still contain unresolved {{variable}} placeholders. Callers may set allowMissingRequestServerBase where a full absolute URL is intentionally optional (for example the embedded modal layout in OperationBlock, or API Reference onBeforeRequest hooks that build against the document origin).
  
  buildRequest returns a Result (ok / err) with stable error codes such as MISSING_REQUEST_SERVER_BASE, INVALID_REQUEST_FACTORY_URL, and BUILD_REQUEST_FAILED for unexpected synchronous failures. Those failures are wrapped with safeRun from @scalar/helpers, which logs to console.error and maps throws to a string message on the result. The API Reference plugin path logs and skips onBeforeRequest when a preview request cannot be built, so user hooks never run against a half-built fetch payload.
  
  Downstream packages (api-client, api-reference, scalar-app where applicable) unwrap the result, show toasts or logs, and avoid calling sendRequest until the URL is valid.
- #9211: fix: OAuth scope CRUD UI
  - Scope definitions vs selection: adding, editing, or removing a scope on the OAuth flow now goes through dedicated workspace events auth:upsert:scopes and auth:delete:scopes, plumbed from OAuth2 → RequestAuthTab → RequestAuthDataTable and registered in initializeWorkspaceEventHandlers. Updating checked scopes remains auth:update:selected-scopes without newScopePayload.
  - OAuthScopesInput: row hover actions to edit or delete a scope; one shared add/edit modal; when the flow defines no scopes, the summary shows No Scopes Defined, Select All / Deselect All and the expand chevron are hidden, the disclosure summary is disabled, and Add Scope stays outside so it remains clickable; the – before a description is omitted when the description is empty or missing.
  - OAuthScopesAddModal: supports edit mode (scope prop), inline errors for missing name and duplicate names (replacing toast-only validation), trims submitted names, and tests clean up teleported modal DOM between runs.
- #9211: feat: some polish for the scalar-app
- #9211: fix: format raw JSON responses with jsonc-parser
  
  Raw JSON response bodies in the API client are now formatted with jsonc-parser instead of @scalar/helpers prettyPrintJson. The previous path parsed with JSON.parse and re-stringified with JSON.stringify, which coerces every JSON number to a JavaScript Number and loses precision for integers beyond Number.MAX_SAFE_INTEGER (a common pain point for 64-bit IDs and other large values). jsonc-parser formats the document as text, so numeric literals stay identical to the response on the wire while indentation and line breaks are still normalized. JSON with Comments (JSONC) tokens also remain valid alongside CodeMirror’s JSON mode.
- #9211: Remove unwanted scrollbar beside auth scope checkboxes
- #9211: fix: share executable URL build for copy and buildRequest
  
  Copy URL from the operation address bar now matches the URL that is actually sent: path parameters, operation query string, environment substitution, and security schemes that use in: query are all applied the same way as Send.
- #9211: fix: handle registry document and version deletion in document settings
- #9211: fix: prevent address bar from stretching past max width
- #9211: feat: add more analytics events
- #9211: feat: add Preview/Raw tabs for JSON responses with true raw body view
  
  JSON bodies now open on a formatted Preview tab (JSONC pretty-print without JSON.parse round-trip). The Raw tab shows the exact decoded response text. Other media types are unchanged; HTML, images, and other previews already used the same toggle pattern.
- #9211: fix: padding on addressbar with no servers
- #9211: fix: history bug on operation switch
- #9211: fix(api-client): narrow request table parameter info popover width
- #9211: fix(api-client): expand object query parameters in the request UI
- #9211: feat: optimize layout for mobile
  - Hide the document breadcrumb on small screens and surface workspace switching from the menu instead, so the top bar stays uncluttered.
  - Convert the document save / discard / pull / push / publish buttons to header-button styling and only render the trailing divider when there are actual cluster buttons next to it.
  - Stack the address bar onto two rows on small screens so the URL and the action cluster (copy / history / send) each get a full row.
  - Hide the "Log in" affordance from the small-screen top bar (the menu still owns it) and keep only the primary "Register" CTA there.
  - Give the pre-request and post-response script editors proper vertical padding so the help text no longer clips when it wraps.
- #9211: fix(api-client): hide OAuth2 client secret when PKCE is enabled and omit it from token requests
- #9211: fix: posthog stream warning
- #9211: refactor: remove the main import file since it was empty
- #9211: fix(api-client): request body content types — OpenAPI extras, MIME labels, and "Other" without auto Content-Type
  
  The request body dropdown lists built-in types first, then any additional media types from the OpenAPI operation. Labels use the MIME essence (no charset in the label). The Other option is available again for a raw body: it does not add an automatic Content-Type header (users can set one manually). Code snippets avoid injecting Content-Type: other.
  
  getDefaultHeaders and filterDisabledDefaultHeaders are exported from @scalar/workspace-store/request-example; the API client uses them for code snippets instead of a duplicate helper.
- #9211: fix invalid Tailwind gap utility in the address bar
- #9211: fix: prevent stuck response overlay after overlapping sends
  
  Fixes a case where the response loading overlay could stay visible indefinitely and Cancel had no effect after opening an example and sending a request very quickly (or when multiple sends overlapped). The reason for that is that ResponseLoadingOverlay delays showing the spinner by 1s. Each hooks:on:request:sent scheduled a new setTimeout without clearing the previous one. Overlapping sent events could leave an orphaned timer that still called loader.start() after the request had already finished and hooks:on:request:complete had run—so the overlay turned on with no further complete, and Cancel targeted an AbortController that no longer matched the finished request.
- #9211: build: switch Monaco Vite plugin to ESM and align workers
- #9211: chore: move app files from client to scalar-app
Open source →
3.6.15 May 2026
Release notes
Patch Changes
- #9094: chore: reorganize app layout
  
  Move the tabs on top of the page for the app layout and make the layout better for small screens
- #9062: feat: show inline errors in command palette instead of silent disable
- #9079: fix command palette OpenAPI URL imports with surrounding whitespace
Open source →
3.6.05 May 2026
Release notes
Minor Changes
- #9050: feat: support for registry sync and local persistence
Patch Changes
- #9076: fix(api-reference): improve rendering of virtualized code blocks
- #9086: feat: code split tailwind CSS to reduce bundle size
- #9059: feat: added the scalar-app back to open source
- #9075: feat(api-client): team workspaces no longer auto-create a "drafts" document or deep-link to it. New team workspaces start empty and land on the workspace get-started page; local workspaces still seed a drafts document and navigate to it as before.
Open source →
3.5.130 Apr 2026
Release notes
Patch Changes
- #9049: Flush pending debounced operation edits before executing API client requests.
- #9023: chore: use homemade slugger
Open source →
3.5.029 Apr 2026
Release notes
Minor Changes
- #9045: feat: support version switching for regsitry documents
- #9045: feat: ensure teams can have only one workspace and create default workspace of the team on demand
- #9045: chore: migrate api-client from namespaces to teamSlug and convert team workspaces
- #9045: feat: add empty state for the team workspace
- #9045: feat: make breadcrumbs navigable, add workspace selector fallback, and support team logo slots
Patch Changes
- #9045: feat: allow masking all temp urls
- #9045: fix: hide sidebar group label when we have a single group
- #9034: Surface actual OAuth error messages instead of generic failure messages
- #9043: chore: move test documents to cdn
Open source →
3.4.029 Apr 2026
Release notes
Minor Changes
- #9000: feat: support version switching for regsitry documents
- #8986: feat: ensure teams can have only one workspace and create default workspace of the team on demand
- #8986: chore: migrate api-client from namespaces to teamSlug and convert team workspaces
- #9025: feat: add empty state for the team workspace
- #9021: feat: make breadcrumbs navigable, add workspace selector fallback, and support team logo slots
Patch Changes
- #8985: feat: allow masking all temp urls
- #9024: fix: hide sidebar group label when we have a single group
Open source →
3.3.128 Apr 2026
Release notes
Patch Changes
- #8839: Fix modal fade-in animation stutter by replacing v-show with CSS visibility/opacity to avoid forced layout recalculation on open
Open source →
3.3.027 Apr 2026
Release notes
Minor Changes
- #8972: feat: implement the new workspace sidebar
- #8977: feat: add app header
Patch Changes
- #8978: fix: layout height collapse and improve menu behavior
Open source →
3.2.223 Apr 2026
Release notes
Patch Changes
- #8952: Export shared Scalar custom header constants from @scalar/helpers/http/scalar-headers and consume them in request build/send flows.
- #8950: fix: correctly handle custom file imports
- #8951: fix: api client initial routing
Open source →
3.2.122 Apr 2026
Release notes
Patch Changes
- #8940: feat(api-client): support header for web layout
Open source →
3.2.021 Apr 2026
Release notes
Minor Changes
- #8891: feat: support refreshing the token
Patch Changes
- #8877: fix(api-client): prefill oauth2 redirect URI after switching documents
- #8943: feat: added customFetch config to the client
- #8931: fix: close environment selector dropdown after selection
- #8933: feat(api-client): add app-level oauth2 redirect URI override plumbing for auth prefill
- #8932: fix: only enable fake data suggestion for parameteres and request body
- #8907: Fix code sample missing body content type update
Open source →
3.1.018 Apr 2026
Release notes
Minor Changes
- #8865: feat: add plugin support for custom response body content types
Patch Changes
- #8810: refactor: move telemetry to an optional plugin
- #8912: fix: provide a default summary when creating a new temp operation
- #8903: fix: share Postman collection detection from postman-to-openapi
- #8911: feat: switch from Request to RequestPayload to support body with GET
- #8887: fix: invalid json body handling and add root document for bulk operation selection
Open source →
3.0.016 Apr 2026
Release notes
Major Changes
- #8863: feat: remove old api-client exports and make v2 the main export
Minor Changes
- #8632: feat: support generation of random data
Patch Changes
- #8827: chore: removed old client v1 code
- #8828: Add support for text/json media type
- #8840: feat: allow updating the proxyUrl and make options reactive in api-client
- #8735: fix: replace direct cjs mime and curl dependencies with local implementations
- #8848: fix: use search for virtual responses
- #8825: chore: moving files around in preparation for the big deletion of client v1
- #8794: Fix Monaco 0.55 compatibility in JSON/YAML editor language helpers.
- #8817: feat(snippetz): add a Laravel HTTP client plugin for PHP snippets
  
  Added a new php/laravel client generator in @scalar/snippetz, including comprehensive request coverage for headers, cookies, auth, query params, JSON, multipart, form-encoded, binary, and fallback bodies.
  
  Updated generated client registries and schema wiring so the new client is available across Scalar:
  - @scalar/types GROUPED_CLIENTS / AVAILABLE_CLIENTS
  - @scalar/workspace-store reference-config schema
  - generated docs and integration client enums
  Updated api-client expectations for the increased total built-in client count.
- #8849: fix(api-client): improve drag regions
- #8850: chore: remove entities, zod and the parser from oas-utils
- #8823: fix: prevent address bar text from hiding under fade overlay while typing
Open source →
2.43.011 Apr 2026
Release notes
Minor Changes
- #8761: feat: improve UX for creating a new operation
- #8773: feat: suport for set-cookie header
Patch Changes
- #8778: fix: hide examples on modal and always show the http badge on modal
Open source →
2.42.09 Apr 2026
Release notes
Minor Changes
- #8748: feat: support allowReserved for code samples
- #8695: feat: suport pre/post request scripts
Patch Changes
- #8760: feat: exported routePayload type
Open source →
2.41.04 Apr 2026
Release notes
Minor Changes
- #8712: feat: use separate stores for client and shared state on the reference
Patch Changes
- #8728: fix: correctly merge security schemes with the config security
Open source →
2.40.03 Apr 2026
Release notes
Minor Changes
- #8524: feat: move request logic on the store and generate a request builder
Patch Changes
- #8692: feat: replace pretty-bytes dependency with internal helper
- #8518: test(api-client): add regression coverage for oauth2 clientCredentials security body
  
  Adds a regression test that exercises the full oauth2 merge + authorize path for clientCredentials and verifies x-scalar-security-body fields (for example audience) are preserved and sent in the token request body.
- #8661: fix(api-client): support OAuth redirect callback override for Electron-friendly flows
- #8634: feat: implement improved saving UI
- #8647: feat: move addressBar path change from debounce to blur
- #8713: feat: handle pasting and typing urls in the path box
- #8698: fix: missing reference parameters by making skipping behavior opt-in
- #8652: feat: keep form-data file delete action accessible on touch
Open source →
2.39.431 Mar 2026
Release notes
Patch Changes
- #8625: fix: Add Variable button now navigates to environment tab using existing @navigate event pattern
Open source →
2.39.329 Mar 2026
Release notes
Patch Changes
- #8610: fix(api-client): improve editor background color handling
Open source →
2.39.228 Mar 2026
Release notes
Patch Changes
- #8599: fix(api-client): truncate long table tooltip content
- #8590: Group analytic events by api-client product
- #8601: fix: stringify nested form body example values for table rows
Open source →
2.39.125 Mar 2026
Release notes
Patch Changes
- #8577: feat: support document download
- #8473: fix: request body code samples when switching anyOf or oneOf schemas
Open source →
2.39.024 Mar 2026
Release notes
Minor Changes
- #8511: feat: import postman collection custom ui
Patch Changes
- #8564: refactor: move context menu to api client
- #8480: remove the direct @scalar/openapi-parser dependency from @scalar/api-client and reuse existing shared normalization and ref-resolution helpers
- #8526: feat: improve filtering of client selector
- #8554: feat: add telemetry toggle
- #8563: fix: type declarations don't use the full path for imports
Open source →
2.38.420 Mar 2026
Release notes
Patch Changes
- #8529: rewrite declaration aliases in built type files
Open source →
2.38.320 Mar 2026
Release notes
Patch Changes
- #8465: fix multipart encoding.contentType request handling and curl snippets
- #8501: fix allowReserved query parameter support so reserved characters like colons stay unescaped and parameter typings include allowReserved
- #8517: Fix OAuth2 authorization code auth behavior in v2 by including client_id in token exchange for public clients, preventing duplicate scheme entries when selected scopes change, and applying configured default scopes to initial auth selection.
Open source →
2.38.218 Mar 2026
Release notes
Patch Changes
- #8437: refactor: better types for the api-client plugin manager
- #8485: fix: prevent stale SSE response bodies on repeated sends by disabling request caching for SSE requests
- #8466: chore: new build pipeline
- #8470: fix default content type headers for operations without request bodies
Open source →
2.38.117 Mar 2026
Release notes
Patch Changes
- #8468: fix: example extraction, environment navigation and general UI fixes
- #8451: fix(api-client): default-close auth when not required
Updated Dependencies
- @scalar/[email protected]
  - #8468: fix: ignore response examples when generating navigation
- @scalar/[email protected]
  - #8448: fix parser validation for unused path parameters
- @scalar/[email protected]
  - #8453: refactor: remove @ts-expect-error from ScalarTextArea
- @scalar/[email protected]
- @scalar/[email protected]
- @scalar/[email protected]
Open source →
2.38.015 Mar 2026
Release notes
Minor Changes
- #8444: feat: cache last response for an example
Patch Changes
- #8424: fix(api-client): persist oauth credentials location
- #8428: fix: overflow issues for mac app version
- #8447: fix: propagate schema to request body form-data table
Updated Dependencies
- @scalar/[email protected]
  - #8424: feat: export XScalarCredentialsLocation
  - #8445: fix: generate unique id for models
- @scalar/[email protected]
- @scalar/[email protected]
- @scalar/[email protected]
- @scalar/[email protected]
Open source →
2.37.013 Mar 2026
Release notes
Minor Changes
- #8426: feat: sync with source flow with conflict resolution
Patch Changes

Updated Dependencies
- @scalar/[email protected]
  - #8426: feat: interact with the original and intermediate documents
- @scalar/[email protected]
- @scalar/[email protected]
- @scalar/[email protected]
- @scalar/[email protected]
Open source →
2.36.212 Mar 2026
Release notes
Patch Changes
- #8414: fix(api-client): pass example picker attributes to button component
Updated Dependencies
- @scalar/[email protected]
  - #8327: fix: markdown tables with specified width attributes in td/th break the layout
- @scalar/[email protected]
  - #8420: fix TypeScript access to navigator.userAgentData in isMacOS without ts-expect-error
- @scalar/[email protected]
- @scalar/[email protected]
- @scalar/[email protected]
- @scalar/[email protected]
- @scalar/[email protected]
- @scalar/[email protected]
- @scalar/[email protected]
- @scalar/[email protected]
- @scalar/[email protected]
- @scalar/[email protected]
- @scalar/[email protected]
Open source →
2.36.111 Mar 2026
Release notes
Patch Changes
- #8403: Persist auth url and token url in local storage
- #8402: Fix raw binary request bodies so uploaded files are sent correctly and code samples show file references.
- #8398: fix code snippet HAR request URL generation to URL-encode substituted path parameter values, matching request sending behavior.
- #8386: feat: app drag region for macos
- #8408: Use the secret oauth urls before the default flow urls
- #8407: Fix conditional rendering for token URL
Updated Dependencies
- @scalar/[email protected]
  - #8393: fix: correctly update active tab on tab close event
  - #8403: Persist auth url and token url in local storage
- @scalar/[email protected]
  - #8404: Preserve duplicate query parameters in generated code snippets. php/guzzle: preserve duplicate query parameters as arrays.
- @scalar/[email protected]
  - #8386: feat: add spacer slot to sidebar
- @scalar/[email protected]
- @scalar/[email protected]
- @scalar/[email protected]
Open source →
2.36.010 Mar 2026
Release notes
Minor Changes
- #8396: feat: preselect correct authentication for document and operation
Patch Changes
- #8394: chore: rollback export document button
Open source →
2.34.110 Mar 2026
Release notes
Patch Changes

Updated Dependencies
- @scalar/[email protected]
  - #8381: feat: add mcp config support
- @scalar/[email protected]
- @scalar/[email protected]
- @scalar/[email protected]
- @scalar/[email protected]
- @scalar/[email protected]
- @scalar/[email protected]
- @scalar/[email protected]
Open source →
2.34.09 Mar 2026
Release notes
Minor Changes
- #8365: feat: store oauth flow refresh tokens on the auth store
Patch Changes
- #8356: fix: make fallback theme reactive
Updated Dependencies
- @scalar/[email protected]
  - #8347: chore: export server workspace type
  - #8365: feat: store oauth flow refresh tokens on the auth store
- @scalar/[email protected]
  - #8357: chore: improve performance and memory usage of bundler
- @scalar/[email protected]
  - #8366: fix(components): clean up search components and add snapshots
- @scalar/[email protected]
- @scalar/[email protected]
- @scalar/[email protected]
- @scalar/[email protected]
Open source →

@scalar/api-client

Release timeline

Releases

Minor Changes

Patch Changes

Patch Changes

Minor Changes

Patch Changes

Minor Changes

Patch Changes

Minor Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Minor Changes

Patch Changes

Minor Changes

Patch Changes

Minor Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Minor Changes

Patch Changes

Minor Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Minor Changes

Patch Changes

Patch Changes

Minor Changes

Patch Changes

Patch Changes

Minor Changes

Patch Changes

Minor Changes

Patch Changes

Patch Changes

Minor Changes

Patch Changes

Patch Changes

Patch Changes

Minor Changes

Patch Changes

Minor Changes

Patch Changes

Major Changes

Minor Changes

Patch Changes

Minor Changes

Patch Changes

Minor Changes

Patch Changes

Minor Changes

Patch Changes

Minor Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Minor Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Updated Dependencies

Minor Changes

Patch Changes

Updated Dependencies

Minor Changes

Patch Changes

Updated Dependencies