The API client lives inside the docs.

A console, not a "Try it out" button.

Every operation renders a form built from its own schema: path, query, header and cookie parameters with their real serialization — style, explode, deepObject, allowReserved — and a body editor that knows the media type. A discriminated oneOf gets a variant selector rather than a raw JSON box.

The request is a real fetch from the reader’s browser to your API. Nothing is proxied, because there is no server here to proxy it.

When a call fails, the failure is named rather than guessed: offline, mixed content, blocked by CORS, or simply unreachable. Response headers are read back as intelligence — rate limits, Retry-After, Deprecation and Sunset, Link pagination, correlation ids.

Environments carry the secrets, not the page.

An environment holds a base URL, variables and default headers, and colors itself so nobody sends staging traffic to production by accident. {{var}} is interpolated just before the request leaves — and if a variable is missing the send is blocked rather than shipping the literal.

Sensitive values are masked in the UI and redacted in every export. OAuth2 flows run in the browser with PKCE; where the host page already holds a session, it can hand the reader a token without ApiGlow ever storing one.

A whole environment can be handed to a teammate as a single setup link, built from scratch without creating it locally first. Locked deployments set environmentsLocked and readers get the environments you shipped, unchanged.

{
  "environments": [
    {
      "name": "Production",
      "url": "https://api.example.com",
      "variables": { "token": { "value": "", "sensitive": true } }
    }
  ]
}

Ten snippet languages, and the import direction too.

Every request generates a copyable snippet in cURL, fetch, Node, Python, PHP, Ruby, Java, C#, Go or HTTPie — regenerated live as the form changes, so the snippet is always the call you are actually looking at.

The direction most tools forget is the one back in. Paste a cURL command, drop a Postman v2.1 collection or a HAR file, and you land in a pre-filled console with the method, headers and body recognized. Requests export as cURL, Postman, Markdown or HAR, secrets redacted by default.

The history is the reader's, and it stays theirs.

Every call is kept in the reader’s own IndexedDB — filterable, replayable, bounded so it cannot grow without limit. An operation page shows its recent calls; the overview shows what gets used most.

None of it leaves the browser. There is no account to create and no server to send it to.

A workflow is a document, not a script.

A scenario is a declarative sequence of requests. Capture it from the console, chain a value by clicking it in a response, and ship it with your documentation. Where the industry answers “chain requests” with JavaScript, ApiGlow answers “click the response” — which is also why there is no scripting surface to review.

Run it two ways: “run all” produces a per-step report, and step-by-step mode executes each request in the real console, turning an authored scenario into an interactive tutorial. Steps carry timeouts, continueOnFailure, four assertion operators and JSONPath extractions.

Scenarios import and export Arazzo 1.1, the OpenAPI Initiative’s workflow format — and export again as a GitHub Actions or GitLab CI job that runs the same document through a third-party runner, with secrets passed as names, never values.

{ "features": { "tryIt": false, "scenarios": false } }