npm / @scalar/api-client
@scalar/api-client
What changed in @scalar/api-client 3, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-24.
2 breaking1 security2 deprecations3 new APIs and options4 behavior and defaults12 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli init@scalar/api-client 324 changes
Breaking changes 2
The #backdrop slot is removed from ScalarDropdown, ScalarPopover, ScalarListbox, and ScalarCombobox; style the floating element with class instead.
ScalarFloatingBackdrop is deprecated in favor of bg-b-1 dark:bg-b-1.5; it uses the same surface styles and no longer clips its slot or draws a real border.
Security 1
OAuth authorization and desktop external links are restricted to HTTPS or HTTP for local development URLs before opening.
Deprecations 2
The brightness-lifted utility is deprecated in favor of bg-b-1 dark:bg-b-1.5.
This CSS custom property is deprecated in favor of bg-b-1 dark:bg-b-1.5.
New APIs and options 3
Built-in Traditional Chinese (Taiwan) translations are available across API Reference, API Client, and schema blocks, including case and underscore variants.
A new utility draws a hairline border that can stack with shadow-* without taking up layout space.
Users can inspect all writable fields alongside custom examples without changing their request payload.
Behavior and default changes 4
The searchable picker now shows empty optional fields of expanded object query parameters.
The action appears on authentication fields only when a default differs from the current value; cleared OAuth2 access tokens retain it to return to the Authorize form.
Floating surfaces paint their own background, border, and shadow instead of using an absolutely positioned backdrop layer.
Tailwind's default inset-shadow sizes are reset, matching the other theme namespaces.
Fixes and other changes 12
The shared Example/Examples popup displays authored server-variable examples, including examples from referenced variables, with copy support.
Popups align with their labels to avoid overlapping the sidebar.
The label remains clickable when hovered.
The authorization form appears again after OAuth access and refresh tokens are cleared.
Document-backed API key name edits are preserved for export, configured names can be cleared, and configured overrides are released when the default name is restored.
Shared component styles no longer override host page body backgrounds and margins, including with CSS layers; standalone bundles retain full-page body styling.
The action stays rightmost in the bearer token's Get a token row, with the settings gear to its left and Refresh between them.
Disabled field values are preserved in the interface but excluded from requests.
Checkboxes for expanded query parameters now operate independently.
Cookie persistence now gives Max-Age precedence over Expires.
The toggle appears only when a field has a value, and an emptied field becomes masked again.
Form body fields resolve structural allOf objects, annotation-only wrappers, and selected oneOf/anyOf variants while preserving descriptions, nested inputs, and multipart value types when switching variants.