v2026.7.28

Desktop App

Platform	Downloads
macOS	Apple Silicon (DMG) · Intel (DMG)
Windows	Installer (EXE)
Linux	AppImage x64 · AppImage ARM64 · install script
Debian / Ubuntu	x64 (deb) · ARM64 (deb)
Fedora / RHEL	x64 (rpm) · ARM64 (rpm)

Enterprise - Managed deployment (MDM / GPO)

Platform	Downloads
macOS	PKG Apple Silicon · PKG Intel
Windows	MSI

macOS PKGs are signed and notarized; the Windows MSI is Authenticode-signed.

Browser Extension

Browser	Store
Chrome	Chrome Web Store
Firefox	Firefox Add-ons
Edge	Edge Add-ons

Terminal - CLI & TUI

Platform	Download
Linux (x64)	oh-2026.7.28-linux-x64
macOS (Apple Silicon)	oh-2026.7.28-mac-arm64
Windows (x64)	oh-2026.7.28-win-x64.exe

Checksums: SHA256SUMS.txt · GPG signature · signing key

Install scripts & notes

Install script (verifies checksums, installs oh to ~/.local/bin):

curl -fsSL https://updates.openheaders.io/install.sh | sh

Windows (PowerShell):

irm https://updates.openheaders.io/install.ps1 | iex

No Node.js required (npm install -g @openheaders/cli is the Node channel). macOS binaries are signed and notarized; the Windows oh is unsigned — SmartScreen warns on first run (More info → Run anyway). Script copies on this page: install-oh.sh · install-oh.ps1

Team - Server Daemon

Platform	Download
Linux (x64)	ohd-2026.7.28-linux-x64
macOS (Apple Silicon)	ohd-2026.7.28-mac-arm64
Docker	ghcr.io/openheaders/ohd:2026.7.28

Checksums: SHA256SUMS.txt · GPG signature · signing key

Install scripts & notes

Install script (verifies checksums, installs oh + ohd to ~/.local/bin):

curl -fsSL https://updates.openheaders.io/install.sh | sh -s -- --with-daemon

Docker:

docker run -d -p 127.0.0.1:8137:8137 -v oh-data:/data ghcr.io/openheaders/ohd:2026.7.28

---

What's New

Requests

• HTTP version control — every request gains an HTTP version
  setting: Auto (the default) negotiates with the server, or pin
  HTTP/1.1, HTTP/2, HTTP/2 (prior knowledge), or HTTP/3. A pinned
  version the server can't speak fails with a clear error naming the
  setting — never a silent downgrade.
• HTTP/3 over QUIC — sends can now ride HTTP/3 end to end, a
  first among API clients. The QUIC engine ships inside the app and
  honors the request's trust settings — SSL verification off, custom
  CAs, and client certificates — so self-signed local endpoints work
  the same as on the other versions.
• Cleartext HTTP/2 — HTTP/2 (prior knowledge) skips negotiation
  and speaks HTTP/2 immediately, including over plain http:// — the
  route to h2c backends and internal services.
• Faster suites — running a collection no longer pays the
  per-origin rate limiter that paces background refreshes, so a
  many-request suite against one host runs at full speed.

Proxy

• Outbound proxy — Settings → Proxy → Outbound Requests routes
  the app's sends through a proxy. System follows the operating
  system's proxy settings and shows a read-only snapshot of what the
  OS reports; Manual takes a single proxy URL speaking HTTP, HTTPS,
  or SOCKS5, with live validation as you type; PAC evaluates a proxy
  auto-config script from a URL or a local file. A resolve preview
  shows the route a URL would take, in every mode.
• Per-request proxy — request settings gain a Proxy setting:
  inherit the app-wide proxy (the default), force a direct
  connection, or name an explicit proxy for just that request.
• Everything rides it — WebSocket and gRPC connections tunnel
  through the proxy too, and OAuth token refreshes and workflow steps
  follow the same rules. The bypass list follows curl's NO_PROXY
  semantics.
• Credentials from the vault — proxy authentication and client
  certificates are picked from vault entries in searchable selects
  with a manage-in-the-vault shortcut; the secret value is read at
  send time, never copied into settings.
• Wire truth — every result says how it actually traveled: the
  network popover and the WebSocket/gRPC meta strips name the proxied
  route, and a direct send shows no badge at all.

Request settings

• Redesigned settings tab — every setting sits in a scannable row
  with its own reset and undo, groups fold from the keyboard, and an
  info popover per setting previews how an example send behaves.
  Inputs state their defaults, show an example format, and validate
  live; an out-of-bounds value explains the violated bound.
• Honest saves — invalid settings block the save and keep the
  draft marked dirty, and clearing a setting truly unsets it instead
  of storing an empty value.
• Unsaved changes at a glance — tabs, badges, and the scripts
  rail mark unsaved edits in one distinct tone until you save.

Response

• Wire truth on every send — the Network popover now always shows
  the HTTP version that was actually negotiated on the wire, whichever
  version carried the send.

Polish

• Menu-bar icon — the tray icon is now a proper template image on
  macOS, so it matches light and dark menu bars.