--- title: "New from Zuplo - April 2026" description: "" canonicalUrl: "https://zuplo.com/changelog/2026/05/01/monthly-changelog" pageType: "changelog" date: "2026-05-01" tags: "runtime, dev-portal, portal, cli, performance" --- April 2026 ships the long-awaited **OpenAPI security schemes** support in the Dev Portal, the most-requested feature from Dev Portal users, alongside a **redesigned API Catalog** with full-text search and category filtering, and **full custom domain lifecycle management** in the Zuplo CLI. ## Highlights ### OpenAPI Security Schemes in the Dev Portal The Dev Portal now fully supports [OpenAPI security schemes](https://spec.openapis.org/oas/v3.1.0#security-scheme-object). APIs that define `securitySchemes` in their OpenAPI spec automatically display security badges on operations, show scheme details in tooltips, and allow users to authorize directly in the API playground. **Key capabilities:** - **All five scheme types supported**: API Key, HTTP (Bearer/Basic), OAuth2, OpenID Connect, and Mutual TLS - **Interactive playground authorization**: Users can enter credentials, complete OAuth flows (Authorization Code with PKCE, Client Credentials), and test authenticated endpoints directly in the playground - **Persistent credentials**: Credentials are stored per session so users don't need to re-authenticate on every page - **Operation-level overrides**: Individual operations can override global security requirements, including marking endpoints as public If your OpenAPI spec already defines `securitySchemes`, security badges appear automatically on upgrade. To enable interactive OAuth flows in the playground, configure an [authentication provider](https://zuplo.com/docs/dev-portal/zudoku/configuration/authentication) in your `zudoku.config.ts`. To disable security display entirely, set `disableSecurity: true` in your API options. See the [OAuth Security Schemes documentation](https://zuplo.com/docs/dev-portal/zudoku/configuration/oauth-security-schemes) for setup instructions. ![Security schemes in API playground](../public/media/changelog/2026-05/security-schemes-playground.png) --- ### Redesigned API Catalog The Dev Portal's API Catalog has been completely redesigned with a modern card layout, full-text search, and category filtering. For teams managing multiple APIs, the catalog is now the best way to help developers discover and navigate your API surface. **Key improvements:** - **Responsive card grid**: APIs are displayed in a 1/2/3-column card layout (mobile/tablet/desktop) with avatars, version badges, and operation counts - **Full-text search**: Press `/` to search across API names, descriptions, categories, and tags - **Category filter chips**: Toggle categories with filter chips, with overflow handling for large category sets - **Status badges**: Mark APIs as Stable, Beta, or Alpha using the new `stability` field in your API configuration ```typescript // zudoku.config.ts const config: ZudokuConfig = { apis: [ { type: "file", input: "./openapi.json", path: "/api", stability: "stable", categories: [{ label: "Core", tags: ["REST"] }], }, ], catalogs: { path: "/catalog", label: "API Catalog", }, }; ``` See the [API Catalog documentation](https://zuplo.com/docs/dev-portal/zudoku/configuration/api-catalog) for all configuration options. ![Redesigned API Catalog](../public/media/changelog/2026-05/api-catalog-redesign.png) --- ### Custom Domains CLI Commands The Zuplo CLI now supports full custom domain lifecycle management. Create, list, update, and delete custom domains directly from the command line. Perfect for CI/CD automation and infrastructure-as-code workflows. ```bash # Create a custom domain assigned to a deployment zuplo custom-domain create \ --hostname api.example.com \ --deployment-name production-deployment # List all custom domains zuplo custom-domain list --output json # Reassign a domain to a different deployment zuplo custom-domain update \ --hostname api.example.com \ --deployment-name staging-deployment # Delete a custom domain zuplo custom-domain delete --hostname api.example.com ``` All commands support `--output json` for machine-readable output and `--account` for multi-account workflows. Error messages now include the full server response, so you can see exactly why a command failed. See the [Custom Domain CLI documentation](https://zuplo.com/docs/cli/custom-domain-create) for all commands and options. --- ## Dev Portal Updates ### Custom JSX Components in OpenAPI Descriptions Custom JSX components registered via `mdx.components` in `zudoku.config.ts` now render inside OpenAPI description fields. Embed rich, interactive components like callouts, warnings, or custom UI directly in your OpenAPI spec descriptions: the same components that work in your `.mdx` documentation pages. ```typescript // zudoku.config.ts const config: ZudokuConfig = { mdx: { components: { SpaceWarning: ({ children }) => (
{children}
), }, }, }; ``` Then use the component in your OpenAPI description: ```yaml paths: /spaces: get: description: | Returns all available spaces. Spaces are region-specific. ``` **Limitation:** Only HTML-like JSX tags work. JavaScript expressions and imports within description fields are not supported. ### Support for x-code-samples Extension The Dev Portal now supports the [`x-code-samples`](https://zuplo.com/docs/dev-portal/zudoku/openapi-extensions/x-code-samples) OpenAPI extension. Add custom code snippets (cURL, Python, JavaScript, etc.) to individual API operations, and they replace the auto-generated examples in the sidecar panel. The language selector adapts automatically to show only the languages you've defined. ```yaml paths: /users: get: x-code-samples: - lang: curl label: cURL source: | curl -X GET https://api.example.com/users \ -H "Authorization: Bearer $TOKEN" - lang: python label: Python source: | import requests response = requests.get( "https://api.example.com/users", headers={"Authorization": f"Bearer {token}"}, ) ``` Operations without custom samples continue to show auto-generated snippets. ### Linked Schema References in Property Lists Properties that reference a named component schema now render the schema name (e.g., `Address`, `Package[]`) as a clickable link instead of showing a generic `object` type label. Click the link to jump directly to the schema definition. Response and request bodies that resolve to a named schema also display the root schema name at the top of the properties panel. This makes complex API schemas much easier to explore, especially for APIs with deeply nested object hierarchies. Also released this month: - **Vite 8 with Rolldown**: Dev Portal builds now run on Vite 8 with the new Rust-powered Rolldown bundler. Client and SSR builds run in parallel for significantly faster builds. Minimum Node.js raised from 22.7 to 22.12 for Node 22 users; default browser targets updated (Chrome 111+, Firefox 114+, Safari 16.4+) - **Customizable 404 Page**: Provide a custom React component for the 404 page via `site.notFoundPage` in your Zudoku configuration - **Robots Metadata Configuration**: Control search engine indexing via the new `metadata.robots` option (e.g., `"noindex, nofollow"` for staging) - **MCP Server Security Schemes**: MCP server configurations now automatically include authentication headers when the underlying API defines security requirements; OpenAI Codex added as a supported MCP client - **Custom OIDC Claims**: Users of custom OIDC providers (like Keycloak) can now access all custom claims through the user profile via an index signature on `UserProfile` - **Accessibility improvements**: ARIA labels added to icon-only buttons, improved callout semantics, and fixed invisible dark-mode `