mirror of
https://github.com/mountain-loop/yaak.git
synced 2026-09-12 22:17:20 -04:00
Gregory SchierandClaude Opus 5
ea3eb5d92d
Some providers need the token request to carry something the plugin does not generate. Entra rejects the exchange without an `Origin` header, Auth0 wants a `realm` body field, and other servers want extra params on the authorize URL. Each of those was a separate request for the same thing: control over what goes out. Adds five key_value lists to the Advanced section, laid out the way Postman and Bruno split the same feature, so the expectation is already set: - Authorization Request Params (query, on the authorize URL) - Token Request Headers / Body Params - Refresh Request Headers / Body Params The design brief called for one list with per-row placement and target selects. The form API has no per-row select — a key_value row is name, value, enabled — and adding a form input type for this was out of scope, so the placement and target dimensions are spent on the list labels instead. The cost is five editors where one would do; the gain is no new plugin API surface, and the labels say plainly where each row lands. Token entries are also sent on refresh, since a server that demands an `Origin` on the exchange demands it on the refresh too, and making users duplicate every row would be the common case. A refresh row of the same name replaces the token row when the two requests genuinely differ. Precedence is one rule everywhere: a custom entry drops every generated entry of that name, then appends. Headers match case-insensitively, form params exactly. Dropping by name rather than substituting in place keeps repeated custom rows, which repeatable headers rely on. Merging happens last, so `Content-Type`, `Accept`, `User-Agent`, and the credential header are all overridable. `redirect_uri` is the one exception, and deliberately: it belongs to the callback flow, not the user, and overriding it points the code at something that is not listening. The third post in the cluster, scope-only-on-authorize, is already fixed and shipped in 2026.7.0 (#579), so nothing here re-solves it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
💫 Yaak ➟ Desktop API Client 💫
A fast, privacy-first API client for REST, GraphQL, SSE, WebSocket, and gRPC – built with Tauri, Rust, and React.
Development is funded by community-purchased licenses. You can also become a sponsor to have your logo appear below. 💖
Features
Yaak is an offline-first API client designed to stay out of your way while giving you everything you need when you need it. Built with Tauri, Rust, and React, it’s fast, lightweight, and private. No telemetry, no VC funding, and no cloud lock-in.
🌐 Work with any API
- Import collections from Postman, Insomnia, OpenAPI, Swagger, or Curl.
- Send requests via REST, GraphQL, gRPC, WebSocket, or Server-Sent Events.
- Filter and inspect responses with JSONPath or XPath.
🔐 Stay secure
- Use OAuth 2.0, JWT, Basic Auth, or custom plugins for authentication.
- Secure sensitive values with encrypted secrets.
- Store secrets in your OS keychain.
☁️ Organize & collaborate
- Group requests into workspaces and nested folders.
- Use environment variables to switch between dev, staging, and prod.
- Mirror workspaces to your filesystem for versioning in Git or syncing with Dropbox.
🧩 Extend & customize
- Insert dynamic values like UUIDs or timestamps with template tags.
- Pick from built-in themes or build your own.
- Create plugins to extend authentication, template tags, or the UI.
Contribution Policy
Important
Community PRs are currently limited to bug fixes. If your PR is not a bug fix, link the feedback item where @gschier explicitly gave you permission to work on it. See
CONTRIBUTING.mdfor policy details andDEVELOPMENT.mdfor local setup.