Show HN: CallFlow – VS Code REST client that also captures your terminal's HTTP

CallFlow is a VS Code extension. The free REST client keeps every request as a plain .http file in your workspace — it diffs in git and opens in REST Client if we ever disappear. Pro adds an HTTP debugger: start capture, and every terminal and debug session in the workspace routes through a local proxy on your machine, so you can inspect, save, replay and export the calls your code really made.

Pro free for 14 days in the editor, no account. Buying for a team? Company licence, $49 per seat →

VS Code 1.90+ · Cursor and VSCodium, tested · No account. Your requests stay on your machine. How it works →

Not marketing language — this is the literal request and capture path, because a "local only" promise is only as good as its mechanism.

Collections are folders under .callflow/ in your workspace. Each file holds one or more requests separated by ###, in the same format REST Client has read since 2016: method and URL, headers, a blank line, the body. There is no database, no proprietary bundle, and nothing that stops working if you uninstall the extension. The files diff in git like any other source.

environments.json holds your variables per environment. Any variable you list under secrets is stored in VS Code's SecretStorage instead — the file on disk keeps an empty string, so a token never ends up in a commit. Variables resolve file-first, then environment, then dynamic values like {{$uuid}}, then chained values from an earlier response.

Requests go out over node:http and node:https directly, not fetch, which is what makes DNS, connect, TLS and first-byte timings precise and cancellation immediate. Redirects are followed up to ten times and the Authorization header is never forwarded to a different origin.

Start capture and CallFlow opens a proxy on a random port bound to 127.0.0.1 only. It then sets HTTP_PROXY, HTTPS_PROXY and the CA-bundle variables that Node, Python, curl, Git, the AWS SDK, Deno, Cargo and Java honour — in this workspace's terminals and debug sessions, through VS Code's own environment mechanism. No system proxy setting is touched, nothing outside VS Code is routed, and stopping capture clears it all.

To read HTTPS, CallFlow generates a local CA on first use and keeps the private key in VS Code's storage with owner-only permissions. For terminal targets you do not need to trust it system-wide, because the environment variables point each tool at the CA file directly. System trust only matters for GUI apps, and the exact command is shown before it runs, never behind a silent prompt.

Captured traffic and history can contain the very things you would not want on a screenshot. Values of Authorization, Cookie, Set-Cookie and X-API-Key are masked in the inspector and in HAR export by default (the list is a setting), and you reveal them deliberately, per view. Bodies are stored only in your own VS Code storage and are never synced.

A CallFlow Pro licence is a small signed key that the extension checks entirely on its own, offline, using public-key verification. It never contacts a server to validate a purchase — not at activation, not afterward. That's a deliberate trade: we can't detect a copied key, and we would rather not have the extension report on how your licence is used. The only thing CallFlow sends on its own is an anonymous once-a-day "this install is in use" ping with no licence details in it (see Privacy).

Free is the complete REST client, forever. Pro is the HTTP debugger on top of it — never access to your own files.

Buy CallFlow Pro — $20 One-time. Sold through Paddle. Key shown on screen after payment. Or try every Pro feature free for 14 days in the editor first: no account. Buying for a team? See the company licence just below.

A company licence lets your employer buy CallFlow Pro for everyone who needs it, with one invoice. Same Pro, same offline keys, no accounts and no seat-tracking server: everyone on the team enters the same key and that's it.

Seats

Buy company licence $49 per seat, one-time. One key for the whole team. Tax invoice from Paddle, our reseller.

Need a quote for procurement? Email hello@smallhours.works.

Not "free for now" — free on principle, for the life of the product. Part of why CallFlow exists is that the most-installed REST client in VS Code removed collections from its free tier in August 2025 and moved to per-user monthly pricing, while the free alternative most people fell back to has not had a release since August 2022. Your requests are plain files in your own repository, and exporting history or captures as HAR is free in every tier. Pro sells the debugger. It will never sell you the exit door.

CallFlow launched in September 2026. It has been downloaded about 3,400 times from Open VSX, the registry Cursor and VSCodium install from, though download counts include updates, and it has no reviews yet. So rather than ask you to trust a number, here is what we can state precisely, because it's true of the code today:

CallFlow is free. In VS Code, Cursor or VSCodium, open the Extensions view and search "CallFlow". Cursor and VSCodium get it from Open VSX, VS Code from the Visual Studio Marketplace. Or download the .vsix here for a manual install. Unlock Pro whenever you want the debugger.

Install from the Visual Studio Marketplace

Install from Open VSX (Cursor, VSCodium)

Download callflow-0.2.5.vsix

Works in VS Code 1.90 or newer. The full integration suite, including HTTPS capture, passes in Cursor 3.23 and VSCodium 1.135. Other Open VSX editors such as Windsurf should work the same way but are untested; any editor can use the .vsix via “Install from VSIX…”. Pro licences are sold through Paddle, and one licence works in every editor you use. Buy Pro — $20

Side-by-side pages with sources, including the cases where the other tool is the better pick.

CallFlow vs Thunder Client · CallFlow vs Fiddler Everywhere

From building it: In a VS Code extension, http.request isn't Node's http.request.