Encrypted Text, Sharable Environments, and Nested Functions
2025.2.0
In this article
📦 2025.2.1
Support audience OAuth 2 field
Sidebar scrollbar not clickable
Pasting auth results in invisible text
Editing the URL sometimes crashes the app on Linux
Missing content-length header sometimes
Url input selects text on window focus
Disable proxy without losing configuration
Insomnia v5 import format
Send metadata/auth during gRPC reflection
Copy body only works on first click
Duplicate environment
Missing scrollbar on request list
Command palette not displaying all requests
Elapsed time not stopping on failure
Not rendering text response
Realtime display of response timer
Using Chinese characters in request parameters can result in errors
📦 2025.2.2
Activate the request after importing a Curl command
Format as JSON when application/javascript return JSON
📦 2025.2.3
Stale variables when switching environments
It’s now possible to securely share variables and other sensitive fields
via Directory / Git Sync!
Whether collaborating with a team or simply backing up your workspaces, you can REST 😉
easy knowing your secrets are safe. There are a few different features that make this
possible, so let’s dig into them one by one.
🔐 Encrypted text and variables
Encryption is the main element behind sharing secrets. Without it, you’d be exposing
your secrets to the world as plain-text. 🙈
The new
secure(...)Template Function
can be used to encrypt any portion of text within Yaak—anywhere environment variables
are supported.
Using the secure(...) function within a header value
Encryption must be enabled for each workspace, which will generate and store an encryption
key using your host OS’s keychain. Back this key up and share it with your team, as it
will be necessary to access secure values on other devices.
Workspace encryption keys are encrypted using a master key stored in your OS’s keyring
before being saved to Yaak’s local database.
To avoid remembering to use the secure(...) function, Yaak will use a secure input when
it guesses that a value may contain sensitive text.
Fields like passwords or bearer tokens are obviously sensitive, but Yaak will also try to
guess headers and other fields (eg. a header named X-Token).
Potentially-sensitive fields will automatically use secure inpu
🔄 Sharable environments
Environments were previously excluded from directory sync to prevent accidentally exposing
sensitive values to Git or other tools. With the new encryption feature, environments can
now be marked as “sharable” which will cause them to be included in data exports and
directory sync.
When encryption is enabled, any variable added will automatically be encrypted, and Yaak
will provide a stern warning if a public environment happens to contain unencrypted
values.
Warning when a sharable environment contains unencrypted variable
Secure values needed to be usable within template function arguments, so I made it happen.
Yaak now also supports nested template functions and variables!
It’s now possible to chain functions to do useful things like get the hash of a password.
Gregory Schier