Requests that pass values along.
A lightweight Postman alternative that runs in a browser tab. Group requests into collections, send them, read the response. Then chain them: log in, keep the access_token, and every later request that says Bearer {{token}} uses it.
Demo password: demo1234. Click ‘Load the example’, then ‘Run all’: it logs in to the built-in demo API and creates, reads and deletes a note.
Chaining, not copy-paste.
Real API work is a sequence: create something, keep its id, use it in the next call. APIForge makes that sequence a collection you can run.
Variables everywhere
{{variables}} in the URL, headers and body, variables inside variables, and {{$uuid}} or {{$timestamp}} for fresh values. Undefined ones are flagged with the request that sets them.
Extract rules
Save data.items[0].id from the JSON body, a header or the status code into a variable. Or click any value in the response tree to make the rule.
Collection runner
Run the whole collection or one folder in sidebar order, optionally stopping at the first failure, with each step's status, time and extracted values.
What it looks like
The runner going through the example collection, a request with its response tree, and the variables panel with values pulled from earlier responses.
Key concepts & stack
Server-side send
Browsers enforce CORS, so the page posts the finished request to /api/send and the server makes the call with httpx.
SSRF guard per hop
Every hop must resolve to public addresses. Redirects are followed by hand so each new host is checked, and Authorization and Cookie are dropped when the host changes.
One variable engine
Variables are filled in by TypeScript in the browser, so the URL preview, send, runner and cURL export all give the same result.
Autosave without losing keystrokes
Each edit bumps a revision number; a debounced flush saves dirty requests and only clears the ones that didn't change during the save.
Postman import
Postman v2.1 collections import with their {{variable}} syntax unchanged. Nested folders are flattened to one level; scripts and collection auth are listed as not carried over.
Built-in demo API
/demo has login and a notes resource, so the example collection works with nothing else running.
Run your own
Locally, ALLOW_PRIVATE_TARGETS=true lets you test APIs on localhost.
API
- 1Install, then set
APP_PASSWORDin.env:cd backend && uv sync cp .env.example .env - 2Start it on port 8000:
uv run uvicorn app.main:app --reload
App
- 1Install and start Vite:
cd frontend && npm install npm run dev - 2Open it, load the example and run it:
http://localhost:5173