Hoppscotch

Promptfree, for everyone, and the only version there is

Copy the prompt for Claude CodeCopy the prompt for CodexCopy the prompt for Cursor

Copy

Build me the API client workspace I actually need instead of a hosted Hoppscotch: collections and environments shared with a team, with control over who sees which secrets.

Read this first: Hoppscotch is open source and self-hosting it is a real answer — the fee buys a hosted instance and access control. Build this when the requirement is a team sharing collections without anyone's production credentials being in a file that syncs to everybody.

STACK
- Node 20+ with Fastify, server-rendered HTML with vanilla JS for the request pane
- SQLite through better-sqlite3, WAL mode
- Requests executed by the server, not by the browser — which sidesteps CORS entirely and is the main reason to have a server at all
- Caddy in front

THE DATA MODEL
- workspaces: id, name, slug; workspace_members: workspace_id, user_id, role
- collections: id, workspace_id, parent_id, name, position, auth_json, headers_json — auth and headers inherited by children
- requests: id, collection_id, name, method, url, headers_json, query_json, body_kind, body, auth_json, scripts_json, position
- environments: id, workspace_id, name, is_shared, variables_json, secrets_encrypted, visible_to_roles_json
- runs: id, request_id, environment_id, actor_id, status_code, duration_ms, request_snapshot_json, response_headers_json, response_body_path, response_bytes, error, at
- history kept per user, and shared runs kept per workspace
- tests: part of the request — assertions with their results per run

THE REQUEST
- Every method, arbitrary headers, query parameters as a table, path parameters
- Bodies: JSON with a formatter and a validator, form-encoded, multipart with file upload, raw text, binary, GraphQL with its own query and variables panes
- Authentication: none, basic, bearer, an API key in a header or a query, OAuth 2 with the client credentials and authorisation code flows, and the token stored where secrets go
- Inheritance from the parent collection, with the effective value shown so it is never a mystery which header is being sent
- The response: pretty-printed JSON with folding, headers, cookies, timings broken into DNS, connect, TLS and transfer, and the size. Save it, copy it, download it
- Generate a curl command from any request, and import one by pasting it

SECRETS, WHICH IS WHAT THE PAID TIER IS FOR
- Environment variables are of two kinds: plain, which everyone in the workspace sees, and secret, which is encrypted at rest and readable only by the roles allowed
- A secret's value is never sent to a browser that may not see it. The request runs on the server, where the value is resolved — so a developer can call the staging API without ever holding its key
- Secrets redacted from every stored run, every log and every shared response by key name and by value match
- An audit entry for every read of a secret and every change to one
- Personal environments that are never shared, for the credentials that belong to one person

RUNNING FROM THE SERVER
- The server makes the request, which removes CORS as a concern entirely
- Guard it: an allow-list or a block-list of destinations, and a hard refusal to call private address ranges unless explicitly permitted. A tool that fetches any URL an authenticated user types is a server-side request forgery machine, and it sits inside your network
- Timeouts, a response size cap, and a redirect limit
- Optionally through a local agent, so a developer can call something only their machine can reach — with the agent making the request and the workspace only holding the definition

SCRIPTS AND TESTS
- A pre-request script and a test script per request, in a sandbox with a time limit, no filesystem and no network of its own
- Set and read variables, and assert on status, headers, body and duration
- A collection run: every request in order, with variables carried between them, and a pass or fail summary
- Run a collection from the command line with an environment named, which makes it a smoke test in CI

SHARING
- Roles: admin, editor, viewer. A viewer can run a request but cannot see a secret or change a collection
- A shared link to one request or a whole collection, read-only, revocable
- Import and export in the common formats — OpenAPI, and the shapes the popular clients use — so nothing here is a one-way door

OPERATIONS
- .env: DATABASE_PATH, STORAGE_PATH, BASE_URL, ENCRYPTION_KEY, SESSION_SECRET, ALLOWED_DESTINATIONS
- Migrations on boot, each once
- Response bodies stored on disk with a retention policy and a sweeper
- Nightly backup off the machine, restore script
- Health endpoint

WHAT MATTERS MOST
Secret scoping and the outbound request guard. Build server-side execution with the private-address refusal first — it is the difference between a useful internal tool and a hole in your own network — and then make sure a viewer can run a request against production without ever being able to read the key that authorised it.

Give me the repository, migrations, .env.example, a seed workspace with two environments, the CLI runner, and a README with deploy steps behind Caddy and the network guard explained.