API Client

A local-first HTTP workspace that does more than fire requests: it grades response security headers A–F, structurally diffs JSON responses, diagnoses failures with an actionable rules engine, and stores collections as plain YAML on disk so they live in your git repo. Not just another API client.

Why this one?

	API Client	Bruno	Insomnia	Hoppscotch	Postman
Zero install (runs in browser)	✅	❌	❌	✅	❌
Open source	✅	✅	⚠️	✅	❌
Git-friendly collections (plain files)	✅ YAML	✅	❌	❌	❌
Response intelligence (security grade, diff, diagnostics)	✅	❌	❌	❌	⚠️
CORS bypass	✅ proxy / Tauri¹	✅ native	✅ native	✅ extension	✅ native
Script sandbox	🔜 coming soon	✅	✅	✅	✅

¹ Tauri desktop transport is on the roadmap; today cross-origin requests use the standalone CORS proxy (below) or any CORS-permissive API directly.

Features

What actually works today:

• HTTP requests — GET / POST / PUT / PATCH / DELETE (HEAD / OPTIONS coming soon)
• URL, query params, headers, body — JSON, raw, form-data, x-www-form-urlencoded
• Auth — Bearer token, Basic, API key (header)
• Importers — cURL, OpenAPI 3.x / Swagger 2.0, Postman v2.x, HAR
• Retry — exponential backoff with jitter and a per-attempt timeline
• Response viewer — content-type sniffing, JSON/XML/HTML pretty-print, syntax highlighting, virtualized rendering for huge payloads
• Security header grader — scores responses A–F across HSTS, CSP, X-Frame-Options, and more
• Error diagnostics engine — turns status codes and error bodies into likely causes and fixes
• Structural JSON diff — compare any two responses from history, field by field
• Realtime — WebSocket and Server-Sent Events clients
• Collections + folders — nested, with drag-and-drop reorder and move
• Environments + global variables — {{variable}} substitution
• History — last 100 requests, persisted locally
• YAML-on-disk workspace — sync collections to a folder you pick via the File System Access API; commit them to git
• Local CORS proxy — a standalone npx package that bypasses browser CORS

Quick start

Option A — Hosted (zero install)

https://apiclient.dev (placeholder — update with the real deployment URL)

Option B — Run locally

# Terminal 1 — web app
git clone https://github.com/aneeshsharma72067/api-client
cd api-client
npm install
npm run dev

# Terminal 2 — CORS proxy (needed for cross-origin APIs)
npx @api-client/proxy

Or run both at once: npm run dev:full.

Option C — Build from source

npm run build
npm run preview

# In another terminal:
npx @api-client/proxy

CORS proxy

Browsers block cross-origin requests that don't return CORS headers, so a pure-browser API client can't reach most third-party APIs. The proxy is a tiny local server (built with Hono) that forwards each request server-side — where CORS doesn't apply — and adds permissive CORS headers to the response. The web app auto-detects it via a /health check and shows a Proxy active badge; cross-origin requests are then routed through http://localhost:3001/__proxy/<target-url>.

npx @api-client/proxy            # starts on :3001
PORT=3002 npx @api-client/proxy  # custom port

Security: local use only. The proxy forwards to any URL with no auth — never expose it publicly. See packages/proxy/README.md.

In Vite dev mode the same /__proxy/ pattern is served by an in-process middleware (vite.config.ts), so the standalone proxy is only required for built/deployed apps.

Tech stack

• Vite + React 18 + TypeScript
• Tailwind CSS + shadcn/ui (Radix primitives)
• Hono + @hono/node-server — the standalone CORS proxy
• IndexedDB — local request/collection/history storage
• File System Access API — YAML-on-disk workspace sync
• zod — request schema validation, yaml — on-disk serialization

Project structure

src/lib/http/         transport detection, sendHttp(), retry/backoff
src/lib/imports/      cURL / OpenAPI / Postman / HAR importers
src/lib/response/     format sniffing, security audit, error rules, JSON diff
src/lib/workspace/    File System Access workspace scan + write-through
src/components/       request builder, response viewer, sidebar, realtime, import UI
packages/proxy/       standalone Hono CORS proxy (npx @api-client/proxy)

Roadmap

• Script sandbox (pre-request + test scripts)
• HEAD / OPTIONS methods
• Form-data file upload
• Cookie jar
• Desktop app (Tauri native transport)
• Browser extension (alternative CORS bypass)
• Collection runner

Contributing

Contributions welcome.

• Branch from main: git checkout -b feat/<short-name> (or fix/, docs/, chore/).
• Keep PRs focused; describe what changed and why, and call out any user-facing or breaking changes.
• Match the existing code style — the repo runs ESLint (npm run lint) and the web app type-checks clean under tsconfig.app.json.

There's a smoke-test suite for the importers at test/importers-smoke.ts, wired into Vitest via test/importers.test.ts. Run it with npm test. CI runs lint, typecheck, test, and build on every push and PR. New importer behavior should come with an assertion in the smoke suite.

License

MIT — see LICENSE. Copyright (c) 2026 Aneesh Sharma.