A request page is **static until a base URL is declared**. That is the decision,
not a gap: a Bruno collection is written against whatever its author could reach
— routinely a staging host behind a VPN, or a `localhost` port — so a send
button aimed at it offers the reader a failure the page cannot explain, and a
site that guessed a public host would be inventing one.

```ts
{
  type: 'bruno',
  path: 'api',
  label: 'API',
  options: {
    tryIt: {
      baseUrl: 'https://api.example.com',
      variables: { tenant: 'demo' }
    }
  }
}
```

With that, a request whose URL is `{{baseUrl}}/{{tenant}}/orders` gets a client
pointed at `https://api.example.com/demo/orders`.

When the API is served by the documentation site itself, write `baseUrl: '/'`.
The request then goes to whatever origin served the page — the deployed host in
production, `localhost` in development — and never becomes a cross-origin
request that the browser refuses before it is sent.

## Only what the site declared

`variables` is an allow-list and nothing else is guessed. A URL still holding a
variable the site said nothing about gets **no client at all** — half a resolved
URL is a request to the wrong place.

Bruno's own path parameters are different and always work: `:reference` in a URL
becomes an editable box, prefilled with whatever `params:path` committed.

## Where the credentials go

The client is the same one the OpenAPI reference uses, so the answer is the same
one: everything typed into it lives in the component's own state and nowhere
else. It is never written to storage, never sent to the site serving the page,
and never proxied — the request goes from the reader's browser straight at the
API.

A header duxt withheld still gets a box, and the box opens **empty**. Prefilling
it would put the collection author's live token into every reader's form, which
is the leak the withholding exists to stop arriving by the other door.