Conduit REST

A lightweight REST client built by developers, for developers. Send requests, read responses, and manage collections, environments, and credentials without leaving the editor. No second window, no second account, and no second copy of your data. Ever.

Three principles

Local-first. Requests, environments, and credentials never leave your machine. Secrets live in the OS keychain.
No telemetry. No analytics, no opt-in toggle, no "anonymous usage data." Nothing collected, nothing sent. Ever.
Native feel. Themes follow VS Code. Keyboard navigation throughout. Codicons in place of emoji.

Features

Request editor

All standard HTTP methods supported
Tabbed body editor (JSON, XML, text, form-encoded, or raw). The right Content-Type gets set automatically.
Structured Params tab two-way-synced with the URL bar. Disabled rows stay in the table but drop off the wire.
Inline name editing. Tab title and saved request stay in lockstep.
Cmd/Ctrl + Enter sends. Esc cancels an in-flight request.

Authentication

Basic, Bearer, API Key (header or query), and JWT (HS256/384/512, RS256/384/512, ES256/384/512, PS256/384/512), signed at send time.
OAuth 2.0 with Authorization Code (with PKCE), Client Credentials, Password, and refresh. Tokens persist in the OS keychain via Conduit's URI handler.
Auth resolves up the tree: request → folder → collection → none. An Inherit view names the source without rendering the values.
Effective-auth chip next to Send so you always know what's about to attach.

Response viewer

Status, body (formatted), headers, timing, redirect chain, byte size.
Per-tab response history. Page back through earlier responses without re-firing.
Network and TLS errors land with friendly headlines (Connection refused, DNS lookup failed, TLS handshake failed) and a Retry button that re-runs the request.

Three views: Collections, Activity, Environments. Each collapses to an icon when the sidebar is narrow.
Nested folders, multi-select, drag-and-drop reordering, full keyboard navigation.
A permanent Uncategorized collection catches requests you save without picking a destination.
Save as… opens a quick-pick over your collection tree. Pick once, the path sticks.
Sidebar state (active view, expanded folders) restores across sessions.

Environments and templating

{{varName}} resolves anywhere a request takes text: URL, params, headers, body, auth fields.
Active environment switcher in the status bar; one-click swap.
Chained references up to three levels ({{baseUrl}} resolving to {{protocol}}://{{host}}).
Variable scope resolves outermost-first: request → folder → collection → environment → globals.
Built-in tokens: {{$timestamp}}, {{$isoTimestamp}}, {{$guid}}, {{$randomInt}}, {{$requestName}}, {{$collectionName}}, {{$folderName}}.
Hover preview shows the resolved value. Secrets render as •••••••• so you don't leak them while reading the URL bar.
Undefined variables get a yellow inline underline + a tooltip naming the missing key.

Secrets

Variables marked secret live in the macOS Keychain, Windows Credential Vault, or Linux libsecret.
Plain-value environments go to disk; secret values never do.
Renaming, duplicating, or deleting an environment migrates or wipes its keychain entries automatically.
Secret values are stripped from the wire-message envelope so they're never serialized to extension state.

Imports and exports

Import from cURL strings, OpenAPI 3 / Swagger 2 specs, Postman v2.1, Thunder Client, Insomnia v4, and Conduit's own JSON export.
OpenAPI re-import tracks per-field user overrides, so changes you've made locally survive a spec refresh.
Export any saved request as cURL, fetch, Python requests, Go net/http, and more.

FAQ

Where is my data stored? By default, in VS Code's global extension state, shared across every VS Code or VSCodium window on your machine. Secrets go through vscode.SecretStorage, which routes to the OS keychain. A workspace backend (a .conduit/ folder per project) is on the post-1.0 roadmap; see Coming after 1.0.

Does Conduit phone home? No. There is no analytics endpoint to disable because there is no analytics code. No update check, no usage ping, no error reporter. The only network traffic Conduit originates is the requests you send.

Can I share collections with my team? Today: export to Conduit JSON, share the file, import on the other end. Soon: the workspace backend writes a .conduit/ folder you can commit to git, with one file per request, so you can review collection changes like any other diff.

Does Conduit support GraphQL, WebSocket, or gRPC? Not today. Conduit is REST-first for the 1.0 line. GraphQL is the most common ask and the most likely next protocol; the others are tracked.

Why is the extension proprietary? Conduit is built by a small studio. A proprietary license lets us keep building it as a product without fragmenting the codebase. Bug reports are welcome through the Report an Issue command when it lands.

How does it compare to Thunder Client, Postman, Insomnia, or Bruno? Different product. Conduit is intentionally narrower: it lives in the editor, it doesn't sync to a cloud account, it has no team workspace concept, no scripting surface in 1.0. If you need any of those, you probably want one of the others. If you want a REST client that feels like part of VS Code instead of a guest, that's Conduit.

Coming after 1.0

Workspace storage backend. Opt-in .conduit/ per project, one JSON file per request, git-friendly diffs.
Pre-request and post-response scripts. A sandboxed JS surface for setting variables and running assertions.
More protocols. GraphQL first. WebSocket and gRPC are on the list, not yet on the roadmap.
More importers. HAR, Bruno .bru, and Postman v2.0.
Per-phase timing breakdown. DNS, TCP, TLS, and connect surfaced in the response viewer.

The backlog moves when users ask. There's no roadmap commitment beyond 1.0 today.

Requires

Visual Studio Code or VSCodium 1.109 or later.

Reporting issues

A Report an Issue command ships with 1.0. It opens a confirmation dialog showing exactly what gets included (extension version, host version, OS) and never auto-includes request URLs, headers, bodies, or response data. Until then, sit tight or reach out through the marketplace listing's Q&A.

License

Conduit's own code is proprietary. The bundled open-source dependencies are distributed under their respective licenses, reproduced in full in THIRD-PARTY-NOTICES.md.

Credits

Built on the shoulders of:

undici, the HTTP/1.1 engine behind every request.
Monaco Editor, the request body and response body editors.
React, the webview UI.
jose, JWT signing.
Zustand, webview state.
swagger2openapi, Swagger 2 → OpenAPI 3 normalization on import.
The VS Code extension API + Codicons, for everywhere a glyph belongs.

Full license texts for every bundled package are in THIRD-PARTY-NOTICES.md.

Imperium Design Studio LLC