Onboarding, OAuth2, and REST everywhere

A one-step dino init with authenticated local tests, OAuth2 client-credentials, and full REST coverage across docs, watch, and change tracking.

Dino is the quality layer for your APIs. 1.0.2 makes it faster to point that layer at a real API, adds OAuth2 for the APIs that need it, and finishes REST support so every command works the same whether your API is GraphQL or REST.

Install or upgrade with npm install -g @dino-hq/cli@latest.

Onboarding in one step

dino init now asks only what it needs. It detects GraphQL from your endpoint, writes a real authentication block to .dino.yml, and offers to run your first test right away. To test an authenticated API with no config, pass credentials inline with --header "Authorization: Bearer $TOKEN" or the --token shortcut. A configured credential that cannot be resolved now stops the run instead of quietly testing as if unauthenticated.

OAuth2 client-credentials

APIs behind an OAuth2 token endpoint are now first-class. Declare type: oauth2 in .dino.yml with your tokenEndpoint, clientIdEnv, and clientSecretEnv, and Dino acquires a bearer token and injects it into discovery and every test. Your client id and secret stay in environment variables and are only ever sent to the token endpoint, never written to output.

REST everywhere

REST support is now complete across the CLI. dino docs, dino watch, dino changelog, and dino diff all understand REST APIs from an OpenAPI spec, not just GraphQL. docs renders each operation with its method, path, and parameters, grouped by OpenAPI tag, and change tracking fingerprints request and response contracts so a breaking REST change is caught, never silently diffed as unchanged.

Honest reporting

Operations that were not tested are reported as untested, not scored. Instead of a fabricated red 20 out of 100, an untested operation shows as Untested and is excluded from health averages, so a report never overstates coverage.

Cleaner output and in-editor validation

--quiet no longer swallows your report. stdout carries only the result, so dino scan | jq and redirecting to a file stay clean, while progress and notices go to stderr. Your .dino.yml also validates directly in your editor against the published schema at usedino.dev/schema.json.

1.0.2 keeps a stable command surface. Pin it in CI with confidence.