REST API Client – No Login
A local REST client for VS Code. Collections, environments, and history stay on disk. There is no account, and the extension does not send telemetry.
It is aimed at people who used Thunder Client before 3.0.0 required a login, and at people who still like REST Client's .http files but want a request UI.
What you can do on the free tier
- Pin the REST API Client icon to the activity bar. Collections, History, and Environments are separate views.
- Edit a request: method, URL, query parameters, headers, and a body (JSON, form url-encoded, multipart, or raw).
- Set auth to Bearer, Basic, or an API key in a header or query parameter.
- Send from the extension host with Node's fetch (undici). Localhost and private hosts work. Browser CORS rules do not apply.
- Read the status, time, and size. Pretty-print JSON. Copy the body or save it to a file.
- Store
{{variables}} on an environment. Mark a value as secret and it goes to VS Code Secret Storage, not the JSON file.
- Keep up to 3 environments. Switch the active one from the request editor.
- Import Thunder Client collection and environment exports, Postman v2.1 collections and environments,
.http / .rest files (including ### separators and @variables), and .env files.
- Export a collection to Postman v2.1 or
.http, and an environment to Postman or .env (secret values are omitted).
- Copy a request as cURL, or paste a cURL command into the editor.
- Choose workspace storage (
.restclient/ in the first workspace folder, git-friendly) or a global store on this machine.
- Set a timeout, a proxy (
restClient.proxy, otherwise VS Code's http.proxy), redirect following, and an opt-in "skip TLS verify".
The free tier is the whole client. Pro adds the collection runner and removes the environment cap.
Pro coming soon
This 0.1.0 build does not sell Pro and does not call a license server. PRO_LICENSE_CHECKS_ENABLED in src/constants.ts is false. The license module is still in the repository. Nothing in the extension host calls it while that flag is off.
Running a collection, or creating a fourth environment, shows Pro coming soon. You can still write assertions on a request. They are saved with the collection. They do not run.
When a payment account exists, set the flag to true, set the store and product ids, and rebuild. Until then the free tier is the whole published product.
|
This release |
Later, when the flag is on |
| Send requests, collections, history, import, export, cURL |
Yes |
Yes |
| Environments |
3 total, across workspace and global |
Unlimited with a license |
| Secret Storage for environment values |
Yes |
Yes |
| Collection runner and in-editor report |
Pro coming soon |
License |
| Assertions saved on the request |
Yes |
Yes, and the runner can execute them |
| Account |
Never |
Never. A license key only, and only after the flag is turned on |
Compared with Thunder Client and REST Client
|
Thunder Client after 3.0 |
REST Client (humao) |
This extension |
| Account |
Required since v3.0.0 |
No |
No |
| Phone-home |
Account service |
No |
Only an optional license check |
| GUI collections |
Yes |
No, files only |
Yes |
.http / .rest |
Not the native format |
Native |
Import and export |
| Postman v2.1 |
Import |
No |
Collections and environments |
| Thunder export |
Native |
No |
Collection and environment JSON |
{{variables}} |
Yes |
@name and {{name}} |
Yes, plus $uuid, $timestamp, $isoTimestamp, $randomInt |
| Secrets |
Tied to the account |
In the file |
VS Code Secret Storage, empty in JSON |
| Git-friendly files |
Export when you want a diff |
Yes |
.restclient/*.json, history gitignored |
| cURL |
Yes |
Limited |
Copy and import |
| Where the request runs |
Extension host |
Extension host |
Extension host (undici) |
| Scriptless tests |
Yes |
Response tests in the file |
Status, JSON path, response time |
| Collection runner |
Yes |
No |
Pro, report in the editor |
| Works offline |
Account wall |
Yes |
Yes. Pro keeps a 14-day grace period |
| Last notable change |
3.x login requirement, Oct 2026 |
2022-08-19 |
This release |
Thunder Client's v3.0.0 thread is discussion 1772. This client does not copy Thunder Client's code. It covers the local workflow people described there: collections, environments, a request UI, and files you can commit.
Postman test scripts are JavaScript and are not imported or executed. Assertions you add here are saved on the request. They travel in .http comments (# @assert status 200) and in a _restClientAssertions field on Postman export. Thunder tests for status, JSON path equals/contains, and response time are imported. Other Thunder test actions are skipped with a warning.
GraphQL request bodies from Postman are imported as JSON. There is no GraphQL editor.
Screenshots
The activity bar and the three trees are VS Code's own tree view. These shots are the editor and the run report, which this extension draws. The same PNG files are inside the package at media/screenshots/. There is no Git repository to resolve relative images, so the links are absolute https URLs. npm run package passes that prefix to vsce --baseImagesUrl.
Files
Workspace scope (first folder in the workspace):
.restclient/collections.json
.restclient/environments.json
.restclient/settings.json
.restclient/history.json # gitignored
.restclient/.gitignore
JSON is versioned ("version": 1) and pretty-printed. A newer version is left untouched so a future format is not overwritten.
Secret values are not written. A secret variable looks like { "key": "token", "value": "", "secret": true }. The value lives in Secret Storage under a key scoped to the environment.
Global scope uses the extension's global storage directory. The view title button toggles Workspace / Global. An untrusted folder does not read .restclient until you trust it.
History stores the request as you wrote it (variables are not resolved) plus status, time, and size. Response bodies are not stored.
Settings
| Setting |
Default |
What it does |
restClient.timeoutMs |
30000 |
Abort the request after this many milliseconds |
restClient.proxy |
empty |
Proxy URL. If empty, http.proxy is used unless http.proxySupport is off |
restClient.followRedirects |
true |
Follow redirects |
restClient.insecureSkipVerify |
false |
Skip TLS verification. Leave this off |
restClient.maxResponseBytes |
2000000 |
Bytes kept for the editor and Save |
restClient.historyLimit |
100 |
History entries. 0 turns history off |
cURL -k sets "skip TLS verify" on that request only.
Develop
npm install
npm test
npm run compile
npm run package
npm test runs the unit tests (importers, variables, cURL, assertions, license decisions against a fake License API, and one real loopback request). npm run test:integration launches the extension in VS Code via @vscode/test-electron and checks that it activates and registers commands.
Press F5 in VS Code with the "Run Extension" launch config after npm run compile.
The extension id is restnologin.rest-client-nologin.
Publish
Marketplace listing is free. This 0.1.0 package can be published before a payment account exists. Pro stays behind the coming-soon notice, and the extension does not call out for a license.
- Create a Marketplace publisher with id
restnologin (the publisher field in package.json). The publisher account has to be yours.
- Package with
npm run package. The .vsix is dist/rest-client-nologin.vsix. Screenshot links are already absolute https URLs. The package command passes that same prefix to vsce --baseImagesUrl, and the PNG files are inside the vsix at media/screenshots/. No Git repository is required.
- Publish with GitHub Actions trusted publishing (OIDC). Global Azure DevOps personal access tokens used by
vsce stop working on 1 December 2026. A PAT still works until that date. Docs: Publishing Extensions.
When you are ready to sell Pro, set PRO_LICENSE_CHECKS_ENABLED to true, set LEMON_SQUEEZY_STORE_ID and LEMON_SQUEEZY_PRODUCT_ID to the real product (do not leave them at 0), and rebuild. The license module posts to the license API only after that flag is on.
Install a local build with:
code --install-extension dist/rest-client-nologin.vsix
Privacy
Requests go only to the URL you send. This build does not contact a license server. There is no analytics, crash reporter, or account.
License
The code is MIT. undici is MIT and listed in THIRD-PARTY-NOTICES.md.
