Bruno 4.0 lets you bring your own AI key. Your data stays yours.

Bruno, the open-source API client that stores collections in Git-friendly plain text files, shipped its biggest update yet. Version 4.0, out July 23, lets users plug in their own OpenAI-compatible API keys to power a new AI assistant built directly into the app. The move taps into a broader shift toward open-weight models that give developers full control, a trend reinforced by Gemma 4's 300 million downloads.

Privacy is the core differentiator. Unlike Postman's or Insomnia's AI features, which route requests through their own servers, a risk highlighted by a recent incident where an OpenAI model breached Hugging Face, Bruno's assistant runs on whatever model endpoint you configure, whether your own OpenAI key, a local Ollama instance, or any provider with an OpenAI-compatible API. The AI sidebar understands the active tab, supports model switching, shows diff reviews with accept/reject controls, and keeps a chat history. For scripting and test generation, the assistant now works across requests, folders, and collections.

Bruno's founder, Anoop M D, has long positioned the tool as the anti-Postman, simpler, local-first, and Git-native. With 4.0, that stance extends to AI: instead of building a walled garden, Bruno ships the rails and lets users pick the engine. This philosophy mirrors tools like Andrew Ng's OpenWorker, which also keeps AI workloads on the user's machine.

The release also introduces Apps, lightweight interactive UIs that live inside collections at the request or collection level. Developers can build custom interfaces that communicate with their Bruno requests, opening the door for AI-driven workflows, chatbot-like interactions, and dashboard-like experiences without leaving the client. Apps are currently available for both request-level and collection-level use, with support for listing requests inside collection-level apps.

On the scripting side, Bruno 4.0 adds typed variables (string, number, boolean, object), makes environment and collection variable mutation APIs persist by default, and improves Postman import coverage for collection and global variable APIs. The secret manager got a revamp too: external secret provider configuration moved from a separate secrets.json into environment files, making environments the single source of truth. Legacy secret syntax still works with a migration warning. For running models locally, performance matters, and the latest Sipp.sh library delivers 3x to 5x speedups for local inference.

Performance improvements include a new option to cache collections, cutting app load times. The collection documentation was redesigned with a new design system, theme support, shareable page-based URLs, and an environment switcher. Authentication gains include Akamai EdgeGrid (beta) and improved OAuth2 flow security with state validation that prevents authorization code injection.

OpenAPI Sync, previously in beta, is now GA, with a new default that does not automatically check for spec updates, preserving user-configured working data instead of overwriting it. The CLI also got a boost: support for external secrets from AWS Secrets Manager, Azure Key Vault, and HashiCorp Vault, plus a , secrets-env-file flag for passing credentials.

For developers burned by proprietary API clients that change pricing or privacy policies, Bruno 4.0 proves open-source alternatives can stay competitive without compromising local control and Git-native workflows. The AI assistant is just a sidebar, but it's a sidebar that doesn't send your data anywhere you haven't approved. This commitment to trust aligns with the growing use of open-source AI in regulated industries that demand auditability.