Conduit REST

A lightweight REST client built by developers, for developers. Send requests, read responses, and manage collections, environments, and credentials without leaving the editor. No second window, no second account, and no second copy of your data. Ever.

Three principles

Local-first. Requests, environments, and credentials never leave your machine. Secrets live in the OS keychain.
No telemetry. No analytics, no opt-in toggle, no "anonymous usage data." Nothing collected, nothing sent. Ever.
Native feel. Themes follow VS Code. Keyboard navigation throughout. Codicons in place of emoji.

Features

Request editor

All standard HTTP methods supported
Tabbed body editor (JSON, XML, text, form-encoded, or raw). The right Content-Type gets set automatically.
Structured Params tab two-way-synced with the URL bar. Disabled rows stay in the table but drop off the wire.
Inline name editing. Tab title and saved request stay in lockstep.
Cmd/Ctrl + Enter sends. Esc cancels an in-flight request.

Authentication

Basic, Bearer, API Key (header or query), and JWT (HS256/384/512, RS256/384/512, ES256/384/512, PS256/384/512), signed at send time.
OAuth 2.0 with Authorization Code (with PKCE), Client Credentials, Password, and refresh. Tokens persist in the OS keychain via Conduit's URI handler.
Auth resolves up the tree: request → folder → collection → none. An Inherit view names the source without rendering the values.
Effective-auth chip next to Send so you always know what's about to attach.

Response viewer

Status, body (formatted), headers, timing, redirect chain, byte size.
Per-tab response history. Page back through earlier responses without re-firing.
Network and TLS errors land with friendly headlines (Connection refused, DNS lookup failed, TLS handshake failed) and a Retry button that re-runs the request.

Three views: Collections, Activity, Environments. Each collapses to an icon when the sidebar is narrow.
Nested folders, multi-select, drag-and-drop reordering, full keyboard navigation.
A permanent Uncategorized collection catches requests you save without picking a destination.
Save as… opens a quick-pick over your collection tree. Pick once, the path sticks.
Sidebar state (active view, expanded folders) restores across sessions.

Environments and templating

{{varName}} resolves anywhere a request takes text: URL, params, headers, body, auth fields.
Active environment switcher in the status bar; one-click swap.
Chained references up to three levels ({{baseUrl}} resolving to {{protocol}}://{{host}}).
Variable scope resolves outermost-first: request → folder → collection → environment → globals.
Built-in tokens: {{$timestamp}}, {{$isoTimestamp}}, {{$guid}}, {{$randomInt}}, {{$requestName}}, {{$collectionName}}, {{$folderName}}.
Hover preview shows the resolved value. Secrets render as •••••••• so you don't leak them while reading the URL bar.
Undefined variables get a yellow inline underline + a tooltip naming the missing key.

Secrets

Variables marked secret live in the macOS Keychain, Windows Credential Vault, or Linux libsecret.
Plain-value environments go to disk; secret values never do.
Renaming, duplicating, or deleting an environment migrates or wipes its keychain entries automatically.
Secret values are stripped from the wire-message envelope so they're never serialized to extension state.

Imports and exports

Import from cURL strings, OpenAPI 3 / Swagger 2 specs, Postman v2.1, Thunder Client, Insomnia v4, and Conduit's own JSON export.
OpenAPI re-import tracks per-field user overrides, so changes you've made locally survive a spec refresh.
Export any saved request as cURL, fetch, Python requests, Go net/http, and more.

Conduit can keep collections in a .conduit/ folder inside your workspace instead of (or alongside) global storage. The layout is built for version control: one file per request, deterministic JSON with sorted keys, so a collection change reviews like any other diff.

What's in .conduit/

.conduit/
├── conduit.json                      # workspace meta and the active environment id
├── environments/<name>.json          # one environment per file
└── collections/<name>/
    ├── collection.json               # collection meta and folder tree
    └── requests/<name>.json          # one request per file

How to opt in

Per collection: right-click a collection in the sidebar and pick Save to Workspace. Workspace-backed collections show a small "workspace" badge. Mixed setups are fine (some collections global, some in the workspace).
Everything at once: run Conduit: Move Storage to Workspace from the command palette. Conduit: Move Storage to Global reverses it.
The conduit.storage.backend setting controls where new collections and environments go by default.

What's safe to commit

Everything in .conduit/. Secret values are never written there; they live in the OS keychain. Teammates who pull your collections will see secret variables with empty values and set their own through the Variables tab. Archived OpenAPI specs are also per-machine (re-import once after cloning to enable the re-import differ).

Recommended .gitattributes

.conduit/**/*.json text eol=lf

Merge conflicts

One file per request keeps conflicts small and local. collection.json only changes when folders change, so it stays quiet. If two people set different active environments, conduit.json conflicts are take-either. Duplicate seq values after a merge render harmlessly (they resolve on the next reorder). If a merge leaves a request file pointing at a folder that no longer exists, Conduit places it at the collection root instead of dropping it.

Trust and no-folder windows

Workspace storage needs an open, trusted folder. In untrusted or folderless windows Conduit falls back to global storage and workspace-backed collections stay out of view until trust is granted.

FAQ

Where is my data stored? By default, in VS Code's global extension state, shared across every VS Code or VSCodium window on your machine. Secrets go through vscode.SecretStorage, which routes to the OS keychain. Opt in to per-project storage with the workspace backend (see Sharing collections via git above).

Does Conduit phone home? No. There is no analytics endpoint to disable because there is no analytics code. No update check, no usage ping, no error reporter. The only network traffic Conduit originates is the requests you send.

Can I share collections with my team? Yes. Save collections to the workspace backend and commit the .conduit/ folder (see Sharing collections via git above). One file per request, so collection changes review like any other diff. Export to Conduit JSON still works for one-off sharing.

Does Conduit support GraphQL, WebSocket, or gRPC? Not today. Conduit is REST-first for the 1.0 line. GraphQL is the most common ask and the most likely next protocol; the others are tracked.

Why is the extension proprietary? Conduit is built by a small studio. A proprietary license lets us keep building it as a product without fragmenting the codebase. Bug reports are welcome through the Report an Issue command when it lands.

How does it compare to Thunder Client, Postman, Insomnia, or Bruno? Different product. Conduit is intentionally narrower: it lives in the editor, it doesn't sync to a cloud account, it has no team workspace concept, no scripting surface in 1.0. If you need any of those, you probably want one of the others. If you want a REST client that feels like part of VS Code instead of a guest, that's Conduit.

Coming after 1.0

Pre-request and post-response scripts. A sandboxed JS surface for setting variables and running assertions.
More protocols. GraphQL first. WebSocket and gRPC are on the list, not yet on the roadmap.
More importers. HAR, Bruno .bru, and Postman v2.0.
Per-phase timing breakdown. DNS, TCP, TLS, and connect surfaced in the response viewer.

The backlog moves when users ask. There's no roadmap commitment beyond 1.0 today.

Requires

Visual Studio Code or VSCodium 1.109 or later.

Reporting issues

A Report an Issue command ships with 1.0. It opens a confirmation dialog showing exactly what gets included (extension version, host version, OS) and never auto-includes request URLs, headers, bodies, or response data. Until then, sit tight or reach out through the marketplace listing's Q&A.

License

Conduit's own code is proprietary. The bundled open-source dependencies are distributed under their respective licenses, reproduced in full in THIRD-PARTY-NOTICES.md.

Credits

Built on the shoulders of:

undici, the HTTP/1.1 engine behind every request.
Monaco Editor, the request body and response body editors.
React, the webview UI.
jose, JWT signing.
Zustand, webview state.
swagger2openapi, Swagger 2 → OpenAPI 3 normalization on import.
The VS Code extension API + Codicons, for everywhere a glyph belongs.

Full license texts for every bundled package are in THIRD-PARTY-NOTICES.md.

Imperium Design Studio LLC