Postkid

Postkid is a local-only API client based on Hoppscotch.

It runs entirely on your machine. Request/response, collections, environments, and history stay local. There is no login, teams, cloud sync, or remote backend. A same-origin proxy forwards requests so the browser does not hit CORS.

By default, collections and settings live in browser storage (localStorage). In Chrome or Edge you can optionally store that data in a folder on this computer (Settings → Data storage). Secrets and auth tokens are written as plain text. The folder is on the machine that opens the app, not inside a Docker container.

Derived from Hoppscotch under the MIT license. See VENDOR.md and licenses/hoppscotch-MIT.txt.

Install (npm)

Requires Node.js 22+.

npx postkid

Or install globally:

npm install -g postkid
postkid

Then open http://127.0.0.1:8787

postkid --port 8787 --host 127.0.0.1

The published package is a single CLI: compiled proxy plus the built SPA. Maintainers assemble it with pnpm pack:npm and publish with pnpm publish:npm.

Requirements

• Node.js 22+
• pnpm 10 (development)

Develop

pnpm install
pnpm dev

• App: http://localhost:3000
• Proxy: http://localhost:8787 (default interceptor)

The Proxy interceptor is on by default. Target APIs that omit CORS headers should still work.

Production (single port)

pnpm install
pnpm build
PROXY_BIND=0.0.0.0 pnpm start

The proxy serves the built SPA from packages/web/dist and accepts Proxyscotch-compatible POST / envelopes.

Publish to npm

pnpm pack:npm
pnpm publish:npm

pack:npm builds the SPA and proxy, then writes a publishable tree to npm-package/ (CLI, dist/server.js, spa/). Check it with npm pack --dry-run --ignore-scripts inside that folder before publish:npm.

Docker

docker build -t postkid .
docker run --rm -p 8787:8787 -e PROXY_BIND=0.0.0.0 postkid

Then open http://localhost:8787

Layout

packages/web                      SPA shell
packages/common                   Vue UI, editors, persistence
packages/data                     request/collection models
packages/kernel                   I/O and interceptors
packages/js-sandbox               pre-request / test scripts
packages/codemirror-lang-graphql  GraphQL editor language
packages/proxy                    CORS proxy + static SPA

What is not included

• User login / OAuth / profile
• Cloud sync, teams, shortcodes, Gist
• Backend, admin, desktop, agent
• Browser extension interceptor

Request-level auth (Bearer, Basic, API Key) remains in the REST editor.