Try it out

Execute a real request from the browser, right from an endpoint's page, with auth support and a same-origin proxy to avoid CORS.

Usage

Every endpoint's request panel has a Code / Try it out mode switch next to the language tabs. Try it out is an editable form (base URL, path/query/header params, request body) that executes a real request via executeRequest() and shows the result in a Live tab alongside the declared example responses — pretty-printed when the body is JSON, with a friendly message instead of a raw error on a network/CORS failure. The base URL defaults to the first entry in the OpenAPI document's servers[] array when present, and is always freely editable.

Authentication

Endpoints with a security requirement get an inline auth form, one input per declared scheme:

  • apiKey — goes to a header or query param, per its declared location.
  • http bearer / OAuth2 / OpenID Connect — all accept a token you paste in directly; no OAuth flow is performed.
  • http basic — expects user:pass.

Credentials are global (shared across every endpoint using that scheme, like a real dev token would be) and persist to localStorage so they survive a reload.

When a successful Live response contains a token-shaped field — e.g. a login endpoint's access_token, including nested under an envelope like data.access_token — a "Use as … token" button lets you reuse it as the credential for the rest of the session, no manual copy/paste.

Same-origin proxy

By default, Try it out is a direct fetch() from the browser to the target API, subject to that API's own CORS policy. When nestjs-docfy's DocfyUiModule.setup() (see the API reference) is configured with an OpenAPI document, docfy-ui detects the injected window.__DOCFY_PROXY_PATH__ global and routes the request through a same-origin server-side proxy instead — CORS never applies.

The proxy's allowlist is built only from absolute URLs in the document's servers[] array — there's no implicit "same origin as this request" fallback, since that would depend on client-controlled headers. A request for a disallowed origin, or any other failure at the proxy itself, comes back with an X-Docfy-Proxy-Error response header, so docfy-ui can tell a proxy-level failure apart from a real response from your API.