The request client

A request page is static until a base URL is declared. That is the decision, not a gap: a Bruno collection is written against whatever its author could reach — routinely a staging host behind a VPN, or a localhost port — so a send button aimed at it offers the reader a failure the page cannot explain, and a site that guessed a public host would be inventing one.

{
  type: 'bruno',
  path: 'api',
  label: 'API',
  options: {
    tryIt: {
      baseUrl: 'https://api.example.com',
      variables: { tenant: 'demo' }
    }
  }
}

With that, a request whose URL is {{baseUrl}}/{{tenant}}/orders gets a client pointed at https://api.example.com/demo/orders.

When the API is served by the documentation site itself, write baseUrl: '/'. The request then goes to whatever origin served the page — the deployed host in production, localhost in development — and never becomes a cross-origin request that the browser refuses before it is sent.

#Only what the site declared

variables is an allow-list and nothing else is guessed. A URL still holding a variable the site said nothing about gets no client at all — half a resolved URL is a request to the wrong place.

Bruno's own path parameters are different and always work: :reference in a URL becomes an editable box, prefilled with whatever params:path committed.

#Where the credentials go

The client is the same one the OpenAPI reference uses, so the answer is the same one: everything typed into it lives in the component's own state and nowhere else. It is never written to storage, never sent to the site serving the page, and never proxied — the request goes from the reader's browser straight at the API.

A header duxt withheld still gets a box, and the box opens empty. Prefilling it would put the collection author's live token into every reader's form, which is the leak the withholding exists to stop arriving by the other door.