A quick exercise. Open your API client right now and count:
- How many auth tokens are saved in your environments?
- How many requests contain real customer payloads?
- How many internal hostnames does your collection reveal?
Now the uncomfortable question: whose server is all of that stored on?
For most developers the honest answer is "not mine." And nobody actually chose that — it happened to us.
How API clients quietly became cloud services
If you've been doing this for a few years, you watched the pattern:
- Postman retired the offline Scratch Pad and reorganized everything around cloud workspaces. Monitors and mock servers? They run in — and bill through — Postman's cloud.
- Insomnia shipped a cloud-first release in 2023 and the backlash was strong enough that community forks appeared basically overnight.
- The community answered with Bruno and other file-based tools — a genuinely great move, but most of them cover only the request-builder slice of the job.
So here's the gap: the moment your work touches real traffic — a token, a payload, an internal URL — the most popular tools want it on someone else's infrastructure. And the moment you need more than a request builder (watch live traffic, monitor an endpoint overnight, mock a dead backend), you're buying a second tool or a higher tier.
I got tired of that gap. So I built for the opposite bet.
One app, one JSON file, zero cloud
Orbittest Client is a free desktop API client built on one hard rule: nothing leaves your machine unless you explicitly push it somewhere.
Your entire workspace — collections, environments, history, settings — is one plain JSON file on your disk. Back it up by copying a file. Delete it and it's gone. No account. No login. No telemetry.
The part I'm most proud of isn't the request builder (though it has OAuth 2.0 flows, scripting with a Jest-like assertion API, code generation, and full Postman import). It's the stuff that usually costs extra:
🔍 A traffic-capture proxy, built in. Charles/Fiddler-style HTTPS interception one click away — plus a dashboard that turns captured traffic into latency percentiles, Apdex scores, and an exposed-secrets panel. The first time I ran it, it flagged credentials in traffic from software I didn't even write. That feature alone changed how I audit my own machine.
⏰ API monitors without a subscription. Schedule any collection to run every minute-to-daily, get Slack/desktop alerts with debouncing, schema-drift detection, and SLO tracking — all running locally. There's a CLI that registers monitors with Task Scheduler/cron so they run while the app is closed.
👻 A mock server from recorded responses. Send a request once, flip a toggle, and it's served from http://127.0.0.1:4090 — with dynamic :id routes and realistic latency replay. Your frontend team stops being blocked by a dead backend.
🔐 Secrets treated as radioactive. Variables that look like credentials get auto-flagged, masked in the UI, and redacted from every export and Git push. Before anything leaves the machine, an audit lists anything credential-shaped — names only, never values.
🔀 Team sharing through your Git. A built-in source-control panel commits and pushes collections to your own GitHub repo. Versioned, reviewable API collections with the permissions you already have. No new vendor.
The honest part
Is it better than Postman/Insomnia/Bruno at everything? No — and I wrote the comparison honestly, including the case where Bruno is the right choice over my own tool.
The full breakdown — feature-by-feature table, how HTTPS decryption stays private, what the Pro license does and doesn't gate — is here:
👉 Orbittest Client: The API Client That Keeps Everything on Your Machine
And if you just want to poke at it: download, point it at an API, first request in under a minute — no signup, ever.
I'm a QA engineer building local-first testing tools (browser, Android, and API). If you've been burned by a cloud pivot — which tool was it? I'm collecting war stories in the comments. 👇
Top comments (0)