API Testing Workbench

Engineering & Development

An API testing workbench that runs on your own computer: enter an address on the web page, press send and see the response, organise requests into collections, and use an admin panel. The web app can send requests without signing in; to share a workspace with a team you bring your own sign-in service. You bring it up with Docker Compose, and the database password and the data encryption key are generated at random by a script. Derived from a frozen snapshot of an open-source project under the MIT licence; the delivery adds build files that build the image from source, an orchestration file with three services, a script that generates the password and key, and a quick-start guide in Traditional Chinese.

Subscribe & download See how to start

SubscriptionUS$49 per month

Last run2026-11-02

In practice

Readiness3 / 5

What you need

Few changes needed4 / 5

Who it is for

Individuals and small teams who want to test and organise API requests on their own machine and, when needed, host a shared workspace for a team.

How to start

$ sh scripts/quickstart/init-env.sh
$ docker compose up -d --build

Browse the files

Files in the product repository at the pinned commit. A few house files are left out of the zip.

File overview2,000+ paths

▸packages1941

codemirror-lang-graphql/
hoppscotch-agent/
hoppscotch-backend/
hoppscotch-cli/
hoppscotch-common/
hoppscotch-data/
hoppscotch-desktop/
hoppscotch-js-sandbox/
hoppscotch-kernel/
hoppscotch-relay/
…

▸scripts1

quickstart/

▫ATTRIBUTION.md

▫CHANGELOG.md

▫CODEOWNERS

▫CODE_OF_CONDUCT.md

▫CONTRIBUTING.md

▫LICENSE

▫LICENSE-99LL.md

▫PRODUCT.md

▫QUICKSTART.md

▫README.md

▫SECURITY.md

▫SECURITY.upstream.md

▫TRANSLATIONS.md

▫aio-multiport-setup.Caddyfile

▫aio-subpath-access.Caddyfile

▫aio_run.mjs

▫commitlint.config.js

▫delivery-manifest.txt

▫devenv.lock

▫devenv.nix

▫devenv.yaml

▫docker-compose.yml

▫firebase.json

▫firestore.indexes.json

▫firestore.rules

▫healthcheck.sh

▫jsconfig.json

▫netlify.toml

▫package.json

▫pnpm-lock.yaml

▫pnpm-workspace.yaml

▫prod.Dockerfile

▫tailwind.config.ts

▫Config and hidden files 25

Latest passing run

Clone → Checkout → Toolchain → Build images → Web admin and auth boundary

Pre-purchase Disclosure

What you are buying

A self-hosted API testing workbench: enter an address on the web page, press send and see the response, organise requests into collections, and use an admin panel. The web app can send requests without signing in. After running the password generation script you bring it up with Docker Compose.

Derived from an open-source project under the MIT licence, and not the original project itself. Our work: an orchestration file with three services, build files with an adjusted order, a script that generates the database password and the encryption key, and a quick-start guide in Traditional Chinese.

Delivery is a frozen snapshot: one zip, taken from the product repository at revision 99d6f73.

Known limitations

The service listens only on the local machine, the web app on port 3000, the admin panel on 3100 and the back end on 3170, over plain HTTP
Team sign-in needs your own SMTP service or an OAuth application from Google, GitHub or Microsoft
Single sign-on is a paid-edition feature of upstream, and this product does not include it
The back end’s data sharing switch is off by default, and when turned on it sends totals and a version number to a host run by upstream every week
The web app’s proxy feature has a default address on a host run by upstream, and requests go through it only when you turn the proxy switch on
The terms of service and privacy policy links on the page point to upstream’s own site
On the first start the back end writes its default settings and restarts itself once
Building the web app needs a good deal of memory, and Docker has to be set to 8 GB or more
Once the data encryption key is replaced, the encrypted settings in the database can no longer be read
docker compose down -v deletes users, workspaces and request collections and cannot be undone
The first build downloads build tools and packages from the network, fetching from registries, apk and package repositories during that time
Pinned to the delivered snapshot; it does not follow upstream.

The liability cap, the scope of what is promised and the statutory floor are governed by the Terms of Service.

Vetting record

Everything below was checked against the pinned commit 63273f8. Every verdict carries its full reasoning, an evidence link and the checker; failures are published, not hidden — do not take our word for it, verify it yourself.

5 PASS0 WARN0 FAIL

Source ReviewPASS

Execution surface of the delivery reviewed item by item. Our own additions were read: docker-compose.yml (the database port is not exposed to the host; the web app on 3000, the admin panel on 3100 and the back end on 3170 are all bound to 127.0.0.1 only; it refuses to start when the database password or the data encryption key is missing; the database uses a named volume), scripts/quickstart/init-env.sh (openssl generates random values, .env is mode 600, existing values are not overwritten) and three changes in prod.Dockerfile (the front-end build reads .env.example, the admin panel is built after the web app, and no debug map files are produced at build time). The upstream TypeScript source was not read file by file; the basis is the MIT licence and container isolation.

Script SafetyPASS

The scripts on the buyer’s delivery path were each inspected: init-env.sh is ours (reviewed); the build goes through prod.Dockerfile (the parts we changed were read, along with the FROM and apk install lines: Go, Node.js and the front end are built in separate stages, with no download piped straight into a shell). The database schema is initialised by prisma migrate deploy in a one-off service.

RecencyPASS

This product is a frozen snapshot and does not follow upstream: the upstream source is pinned to the main-line revision taken on the day the product repository was created (see the evidence link), and the product repository is that snapshot plus our own commits.

LicensePASS

SPDX:LicenseRef-99LL-Product

Upstream LICENSE was checked (the evidence link points at the file itself at the pinned version and matches the copy inside the product repository): the standard MIT text, with a copyright line that gives only the year 2022 and names no holder. It allows commercial use, modification, derivative works, redistribution and sale; the duty is to keep the copyright notice and licence text (LICENSE and ATTRIBUTION.md ship in the zip); upstream has no NOTICE file. The decision does not rest on GitHub’s licence field. For the product as a whole the 99LL product licence template is attached: upstream’s LICENSE is kept as it is and LICENSE-99LL.md is added as the sale and liability terms for the part we built, with spdx recorded as LicenseRef-99LL-Product.

Dependency LicensesPASS

This records the declared side, not a scan result: the dependencies are declared in each package’s package.json and locked by pnpm-lock.yaml, and the packages themselves are fetched from their own repositories when the buyer builds; the base images and system packages come from a registry and apk. These dependency trees were not scanned package by package for licences. Upstream has no submodule and no third-party dataset was copied in (see ATTRIBUTION.md).