Test HTTP APIs
without an account
or a CORS error

HITOP is a free, open source API client. Send requests, keep them in collections, script them in JavaScript and run them in order, with everything stored on your device.

Open the web app Mac, iOS and CLI

MIT licensed · On the Mac App Store and the App Store · No sign up

What you get, free

No CORS errors in the browser

The web app sends requests to public APIs through its own proxy, so an API that never set CORS headers still answers. localhost goes direct.

Collections you can run

Group requests by API, reorder them by dragging, and run the whole collection in order to check a flow end to end.

Variables in every field

Write ${baseUrl} or ${token} once per collection and use it in URLs, headers and bodies.

Scripts before and after

JavaScript runs before a request to set a signature or timestamp, and after it to pull a token out of the response for the next one.

History with timings

The last 50 requests with status codes and times. Open one again with a click.

HTTP, GraphQL, WebSocket, gRPC

GraphQL with schema completion, WebSocket connections with saved messages (the web app and CLI), and gRPC calls from the CLI by server reflection or .proto files.

From OpenAPI or Postman

Turn an OpenAPI 3.0 or 3.1 spec or a Postman export into a collection, then sync the next spec version without losing your edits.

Code snippets and diffs

Copy a request as curl, fetch, Python, Go, Java or Rust, and compare a response with a saved example or an earlier one.

No account needed

No sign up and no analytics. Collections live on your device as files. HITOP Cloud, for sharing them, is optional and end to end encrypted.

Team sync, encrypted

Share a collection with your team through HITOP Cloud or your own sync server. Files are encrypted on your device; the server stores ciphertext. Free for 3 people.

Your requests, keys and responses stay on your device. No account, no tracking. Sync only if you want it, encrypted.

From URL to collection in a minute

  1. 1

    Open the web app

    No install and no sign up. Or get the Mac or iOS app.

  2. 2

    Send a request

    Pick a method, paste a URL, add headers and a body. The response comes back highlighted, with headers and timing.

  3. 3

    Save and run

    Save it to a collection, add ${variables} and scripts, then run the collection in order.

One client on every device you test from

The same collections, variables and scripts in each. Move a collection between them as a JSON file.

Web app

Free

Any modern browser

  • Public APIs go through the HITOP proxy, so no CORS errors
  • Requests to localhost go straight from your browser
  • Data stays in your browser storage
Open the web app

macOS

$4.99

One time · macOS 12 or later

  • Native app, requests sent by macOS itself
  • Reaches localhost and your private network
  • Collections saved as files on your Mac
Get the Mac app

iPhone and iPad

$2.99

One time · iOS 17 or later

  • Check an API from your phone in seconds
  • Requests sent by iOS itself, no proxy
  • Collections stored on the device
Get the iOS app

CLI

Free

Linux, macOS and Windows

  • Run whole collections in CI
  • Same collections, variables and scripts
  • cargo install hitop
See it on crates.io

Also free as a browser extension for Chrome and Firefox.

Run the same collections in CI

The CLI is a single Rust binary. It runs collections with their pre and post request scripts, passes values from one request to the next, and writes JUnit and JSON reports for any pipeline.

hitop mcp lets Claude Code, Cursor and other MCP clients list, run and edit the requests of a collection folder, with secrets masked.

Install from crates.io Use HITOP with Claude Code and Cursor

Questions

Why do API calls fail in other browser tools?

Browsers block a page from reading another site's response unless that site sends CORS headers, and most APIs don't. The HITOP web app avoids this by sending requests to public addresses through its proxy at hitop.rws8.tech.

Does the proxy keep my requests?

No. It makes the request and returns the response, without storing or logging headers or bodies. The privacy policy has the details. For secrets you'd rather not pass through any server, use the Mac or iOS app, the CLI or an extension: they send requests from your device.

Can I test localhost?

Yes. The web app sends requests to localhost straight from your browser, so your local API must allow the origin https://hitop.rws8.tech in its CORS headers. For other machines on your network, use the Mac app, the CLI or an extension: browsers block a public page from calling them.

Is it really free?

The web app, the Chrome and Firefox extensions and the CLI are free and MIT licensed. The Mac app is $4.99 and the iOS app is $2.99, each paid once.

Can I bring my Postman collections?

Yes. Import Postman v2.1 collections, and export back to Postman v2.1 or HITOP JSON.

Where is my data stored?

On your device: browser storage for the web app and extensions, files for the Mac app and CLI, app storage on iOS. Nothing is synced to a server unless you turn on hitop sync, which encrypts it on your device first.

Does it work offline?

The Mac app, the iOS app and the CLI work with no internet connection, which is handy for local and air gapped services.

Can I run collections in CI?

Yes, with the CLI: hitop run ./my-api --env ci --reporter junit runs a collection folder from your repository with its scripts and variables and writes a JUnit report (or JSON, or one HTML page). hitop schedule writes a scheduled workflow for you. On GitHub there is an action, and a Docker image for other pipelines.

Send your first request now

Open the web app Read the source

Free and MIT licensed. No account. Your data stays on your device.