We're excited to announce the release of Hoppscotch v2026.6.0! This update brings cookie persistence and reapplication to the desktop app, adds ID Token support for OAuth2 token requests, fixes mock server URL handling for subpath deployments, and introduces Thai language support — alongside backend ownership enforcement, stricter SMTP URL validation, and a fresh round of security patches and bug fixes.

Desktop Cookie Persistence and Reapplication

The desktop app now reliably persists cookies and reapplies them across sessions. This makes authenticated flows smoother when testing APIs that depend on cookie-based sessions.

Get the latest version →

ID Token Support for OAuth2

When working with OAuth2, you can now choose which token to send. Alongside the standard access token, Hoppscotch can use the id_token returned by OpenID Connect providers — useful when an API expects the OIDC identity token for authentication rather than the access token.

Mock Server Reliability

Domain-based mock server URLs now append /backend when subpath access is enabled, so mock URLs resolve correctly for subpath deployments.

Thai Language Support

Hoppscotch is now available in Thai. Thanks to our community translators for helping more developers use Hoppscotch in their own language.

Security Hardening

This release also tightens security on a few fronts:

• Backend APIs now enforce ownership on user history and private user fields, so one account can't read another's data.
• Hardened SMTP URL validation in the self-hosted backend.
• Security patches for the v2026.6.0 dependency chain.

Self-Hosted Admin Dashboard

The self-hosted admin dashboard now surfaces which configuration fields are blocking a save, so operators can spot and fix invalid states without digging through logs.

Bug Fixes

We've also resolved a few bugs in this release:

• New mock servers now default to private, and their public/private visibility is saved correctly on creation.
• Inherited collection headers now correctly resolve environment variables.
• JSON bodies are now preserved in cURL parser conversions.
• The desktop app now syncs the self-hosted instance version from the manifest, reducing version mismatches.

What do you want us to build next? Write to us at hello@hoppscotch.io, join the conversation on our Discord server, or head over to our GitHub repository.