Skip to content
Back to skills

Orpc Openapi Link

ASecurity

Use OpenAPILink in oRPC clients to communicate with OpenAPI-compliant APIs.

  • 8 stars
  • 0 votes
  • 0 copies
  • 1 view
  • Added September 12, 2026
businessgitapi

Works with

  • cli
  • api

Security analysis

A96/100
  • mediumInstalls packages at runtime which could introduce malicious dependencies

Pro shows the line behind each finding and how to fix it

Scanned September 12, 2026

npx -y skills add ali-master/skills --skill orpc-openapi-link --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Orpc Openapi Link?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Orpc Openapi Link
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/ali-master-orpc-openapi-link/badge)](https://www.skillsdirectory.com/skills/ali-master-orpc-openapi-link)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: oRPC OpenAPILink
description: Use OpenAPILink in oRPC clients to communicate with OpenAPI-compliant APIs.
license: MIT
metadata:
  author: Ali Torki
  homepage: https://github.com/ali-master
  version: "1.0.0"
---

# OpenAPILink

Enables communication with an [OpenAPIHandler](/docs/openapi/openapi-handler) or any API following the [OpenAPI Specification](https://swagger.io/specification/) using HTTP/Fetch.

## Installation

```sh
npm install @orpc/openapi-client@latest
```

## Setup

```ts
import type { JsonifiedClient } from '@orpc/openapi-client'
import type { ContractRouterClient } from '@orpc/contract'
import { createORPCClient, onError } from '@orpc/client'
import { OpenAPILink } from '@orpc/openapi-client/fetch'

const link = new OpenAPILink(contract, {
  url: 'http://localhost:3000/api',
  headers: () => ({ 'x-api-key': 'my-api-key' }),
  fetch: (request, init) => {
    return globalThis.fetch(request, {
      ...init,
      credentials: 'include',
    })
  },
  interceptors: [onError(e => console.error(e))],
})

const client: JsonifiedClient<ContractRouterClient<typeof contract>> = createORPCClient(link)
```

> Due to JSON limitations, wrap your client with `JsonifiedClient`. Alternatively, see [Expanding Type Support for OpenAPI Link](/docs/openapi/advanced/expanding-type-support-for-openapi-link).

## Limitations

* Payloads with `Blob`/`File` outside root use `multipart/form-data` and [Bracket Notation](/docs/openapi/bracket-notation).
* For `GET` requests, payload sent as `URLSearchParams` with [Bracket Notation](/docs/openapi/bracket-notation).

## CORS policy

Needs `Content-Disposition` header to distinguish file responses:

```ts
const handler = new OpenAPIHandler(router, {
  plugins: [
    new CORSPlugin({
      exposeHeaders: ['Content-Disposition'],
    }),
  ],
})
```

## Using Client Context

```ts
interface ClientContext { something?: string }

const link = new OpenAPILink<ClientContext>(contract, {
  url: 'http://localhost:3000/api',
  headers: async ({ context }) => ({
    'x-api-key': context?.something ?? ''
  })
})

const client: JsonifiedClient<ContractRouterClient<typeof contract, ClientContext>> = createORPCClient(link)

const result = await client.planet.list(
  { limit: 10 },
  { context: { something: 'value' } }
)
```

## Lazy URL

```ts
const link = new OpenAPILink({
  url: () => {
    if (typeof window === 'undefined') {
      throw new Error('Not allowed on server')
    }
    return `${window.location.origin}/api`
  },
})
```

## Lifecycle

Follows the same lifecycle as [RPCLink Lifecycle](/docs/client/rpc-link#lifecycle).

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.