Open Headers

Open Source DevToolkit, inside a browser extension. Modify live browser requests. Manage API Collections. Team Collaboration.

Local-first: no account, no cloud, your data stays on your machine. BROWSER INTERCEPTOR • Rewrite headers, block, redirect, delay, mock responses, edit bodies and query strings, merge, inject CSS/JS, modify WebSocket and SSE messages • Static rules compile into the browser's own network layer and catch every request: pages, frames, fetch, XHR, images, fonts, scripts • No proxy port and no CA certificate: rules run with the page's own permissions, nothing man-in-the-middles your traffic • DevTools-grade network panel with request and response inspection • Five variable scopes in every rule: vault, environment, collection, workspace, live API CLIENT • HTTP, GraphQL with schema introspection, WebSocket, Socket.IO and SSE right in the browser; gRPC and MQTT through the desktop companion • Collections with folders, environments, OAuth 2.0 with PKCE and refresh, multipart file uploads • Pre- and post-response scripts and assertions • Workflows: chain and schedule requests with dependencies, AND/OR run conditions and parallel steps; every response value lands in a live variable any rule can inject into real traffic • Import from cURL, HAR, Postman, Insomnia and OpenAPI • Encrypted vault for secrets and tokens, referenced by name, never exposed TEAM COLLABORATION • Multi-workspace: your personal workspace and the team's shared one side by side, each in its own tab • Sync through back-ends you control: the desktop app, a box on your LAN, or a self-hosted server • Self-hosted server with SSO, RBAC user management and audit logs • Optional Git back-end for durable workspace history: a new device bootstraps from Git and auto-syncs from there • Concurrent multi-user editing • Work offline, auto-sync when back online Our vision: a platform where everyone can use local tools to generate their own local data and own it, not a cloud vendor middleman. Everything is free to use and free to self-host. Like it should be.