Skip to main content
ApiGlow v0.1.0
EN
FEATURE 02 / 11

Environments and variables, without the separate client.

Base URL, variables and default headers per environment, switched from the header bar, kept in the reader’s own browser. The reason people keep a separate API client next to their docs — removed.

demo.apiglow.dev/#/pet/addPet · petstore.yaml
The environment manager: color picker, auth variables masked as sensitive, and one-click creation from the servers declared in the schema. The environment manager: color picker, auth variables masked as sensitive, and one-click creation from the servers declared in the schema.

REAL SCREENSHOT, SHOWN AT 1:1

One environment per context, color included.

An environment carries a name, a base URL, variables and default headers added to every request. Each gets a color — production in red is visible before the send, not after. You can seed environments from the config so readers land equipped; in multi-spec installations, each spec keeps its own set, fully isolated.
The environment editor: name field, base URL field and the row of color swatches. The environment editor: name field, base URL field and the row of color swatches.
[01]A NAME, A BASE URL, A COLOR
Environments seeded from the config 
{
  "environments": [
    {
      "name": "Sandbox",
      "baseUrl": "https://sandbox.example.com/v1",
      "variables": {
        "auth.bearerAuth": { "value": "", "sensitive": true },
        "accountId": { "value": "acc_123", "sensitive": false }
      },
      "defaultHeaders": { "X-Client": "api-docs" }
    }
  ]
}

A missing variable blocks the send.

{{var}} interpolates in the URL, headers and body. If a variable has no value in the active environment, the send is blocked with a visible signal — the literal {{var}} is never sent to your API, not once. Typing {{ autocompletes from the variables in scope, each with its provenance.

Auth follows your securitySchemes.

Every scheme the schema declares is fillable: bearer, basic, apiKey in a header, query or cookie, OAuth2, OpenID Connect. The convention is one variable per scheme — scheme X reads auth.X — so credentials live where variables live, per environment.

OAuth2 runs entirely in the browser, no backend: Authorization Code with PKCE as a full-page redirect with in-browser code exchange, and client credentials. The config carries a clientId at most — never a secret.

The variables list: auth.petstore_auth, auth.bearerAuth, auth.api_key and the basic-auth pair, masked and flagged sensitive. The variables list: auth.petstore_auth, auth.bearerAuth, auth.api_key and the basic-auth pair, masked and flagged sensitive.
[03]SCHEME X, VARIABLE auth.X

The reader's session becomes the credential.

Docs behind an SSO? The page that embeds ApiGlow can register a small provider, and the app asks it for tokens at runtime — the reader lands on documentation that is already authenticated, nothing to paste. Host-supplied values fill only what the environment leaves empty (a typed value always wins), live in memory only — never stored, always redacted from exports — and a 401 triggers exactly one refresh-and-replay, with a visible note. The auth guide has the full contract.
The host page hands the app a provider 
apidoc.registerCredentialsProvider(async () => {
  const r = await fetch("/api/docs-token", { credentials: "include" })
  return r.ok ? { bearerAuth: (await r.json()).access_token } : null
})

One URL sets a teammate up.

An environment travels as a link. Share the one you have — checked variables carry their value, unchecked ones travel by name with an empty value, the skeleton the recipient fills in — or build one from scratch, a form that produces the link without ever creating the environment on your machine: it writes nothing, anywhere. The recipient sees a review table before a single key is written (created / updated / kept, sensitive values hidden), and the link leaves the address bar immediately. Enough of a format to generate onboarding links from a CI job, too.
An environment, as one link 
https://docs.example.com/#/?setup=eyJ2IjoxLCJlbnYiOnsibmFtZSI6IlN0YWdpbmci…

Locked mode for controlled deployments.

environmentsLocked: true freezes the declared environments: no create, no edit, no delete — only the selector remains. Platform teams publish internal API docs with the right sandboxes pre-wired and nothing to misconfigure.

Everything an environment holds also feeds the try-it console, and its sensitive values are redacted from every export and history entry by default.

Local means unencrypted.

Sensitive variables are masked on display and redacted from exports — but they are stored in clear text in the reader’s browser storage, deliberately, and the UI says so. Avoid production secrets on shared machines.

See it in the live demo.

Open the live demo Read the auth & onboarding guide