API Explorer try-it: enable the panel, serverUrl base URL, and OAuth sign-in#638
Draft
steve-calvert-glean wants to merge 5 commits into
Draft
API Explorer try-it: enable the panel, serverUrl base URL, and OAuth sign-in#638steve-calvert-glean wants to merge 5 commits into
steve-calvert-glean wants to merge 5 commits into
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
steve-calvert-glean
marked this pull request as draft
July 22, 2026 17:21
The full try-it panel (auth, params, body, send, response) has shipped
hidden on every API page — suppressed by two CSS rules from before the
auth/CORS story was clear. Both blockers are resolved:
- CORS: Glean backends explicitly allow the developers.glean.com origin
(verified by preflight — allow-list, not reflection), so requests go
straight from the reader's browser to their own instance. No proxy;
tokens never touch this site's infrastructure.
- Auth: the bearer field accepts Glean-issued tokens and OAuth access
tokens today, persisted in localStorage via authPersistence.
Specs now advertise a single fully-variable server URL ({serverUrl},
default instance-name-be.glean.com) instead of the {instance} template —
matching the SDKs' server_url and supporting non-Glean-hosted
deployments; the explorer's Base URL editor becomes a free-form input.
Transform wired into the openapi pipeline (openapi-server-url.mjs), all
API docs regenerated.
Verified: send path e2e in a headless browser (request fired at the
right URL; the network leg is origin-gated so it only completes in
production — Vercel previews are CORS-blocked by design), light/dark
render reviewed, build/tests/prettier green.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
'Sign in with Glean' in the explorer's Auth section runs a full browser-side OAuth flow against the server URL configured in Base URL: metadata discovery at /.well-known/oauth-authorization-server, Dynamic Client Registration (public client, client_id cached per issuer), PKCE S256 authorization in a popup, token exchange — then the access token is injected into the explorer's bearer state via setAuthData, persisted like a pasted token. No secrets and no server-side component on this site; tokens stay in the reader's browser. Scope is derived from the API group being viewed (search page requests 'search', etc.); unmapped groups request no explicit scope. The button renders only on Client API pages — indexing/platform docs state OAuth is unsupported there. All endpoints and capabilities were verified live against a real instance's metadata (S256, auth method 'none', DCR). The popup callback lands on /oauth/callback (noindex), which relays the code to the opener same-origin and closes. Verified: button gating (client-api only), guard when Base URL is unset, callback route, build/tests/prettier green. The full dance is origin-gated by backend CORS, so end-to-end sign-in needs the production origin — flagged for post-deploy testing. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The samples block was forced to 600px — fine while the request panel was hidden, but it pushed try-it out of view. Now a 320px scrollable card. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
OAuth tokens are accepted by both the Client and Platform APIs — only
the Indexing API requires a Glean-issued token. The gate previously
followed the Client API spec's security description too literally.
Platform scopes map from the flat platform-{group} slugs (agents,
search); unmapped groups request no explicit scope as before.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- Send button joins the pill-button system (radius, sentence case, gdt-primary in both modes) and now matches the OAuth sign-in pill; Collapse all / Clear / Edit / Hide become quiet text buttons - Structural labels (Request, Response, Authorization, Query Parameters, Body) switch from mono shouting to the site's Inter eyebrow voice; mono stays reserved for params, types, and code - Page h1 lifted to the docs display scale; auth summary strip carded - Sidebar: thin always-visible scrollbar, bottom fade, and end padding so the long API nav reads as scrollable rather than clipped All selectors verified against the rendered explorer DOM; light and dark reviewed. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
steve-calvert-glean
force-pushed
the
api-explorer-try-it
branch
from
July 22, 2026 21:49
42f6c76 to
c504bc3
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Turns on interactive try-it across the API reference, in two commits.
Phase 1 — enable the panel. The full try-it UI (auth, params, body editor, send, response) has shipped hidden on every API page — suppressed by two CSS rules from before the auth/CORS story was clear. Both blockers are resolved: Glean backends explicitly allow-list the developers.glean.com origin (verified by preflight), so requests go browser→instance directly with no proxy and no token ever touching this site's infrastructure. Bearer field accepts Glean-issued tokens and OAuth access tokens, persisted via authPersistence.
Specs now advertise a single fully-variable {serverUrl} (matching the SDKs' server_url) instead of the {instance} template, supporting non-Glean-hosted deployments — the explorer's Base URL becomes a free-form input. New transform in the openapi pipeline; all API docs regenerated.
Phase 2 — OAuth sign-in. 'Sign in with Glean' in the Auth section runs a complete browser-side flow against the configured server URL: metadata discovery (/.well-known/oauth-authorization-server), Dynamic Client Registration (public client, cached per issuer), PKCE S256 in a popup (/oauth/callback relays the code same-origin), token exchange, then the access token is injected into the explorer's bearer state. Scope derives from the API group being viewed (search page → 'search'). Client and Platform API pages — only the Indexing API requires a Glean-issued token instead. All endpoints/capabilities verified live against real instance metadata.
Verification: send path exercised e2e headlessly (request fires at the configured URL; the network leg is origin-gated so it only completes in production — Vercel previews are CORS-blocked by design), OAuth button gating and guard states verified, 172 tests green (3 new), clean build, light/dark reviewed.
Needs post-deploy testing on the production origin: one authenticated send (paste-a-token) and one full OAuth sign-in — both are origin-gated and cannot be tested from localhost or previews.
🤖 Generated with Claude Code