FAQ

Does Rewind phone home?

No. The local API binds to 127.0.0.1 and only answers requests from the same machine. The web app talks to it through the Vite dev proxy or through the bundled apps/api/dist/rewind launcher. There is no telemetry, no analytics, no remote update check.

Is there a cloud version?

No. Rewind is intentionally local-only.

Where is my data?

In the platform's application-data directory, unless you overrode it with REWIND_DATA_DIR. See Data and storage for the per-OS path and the env vars you can set.

Can I share my workspace with a teammate?

Yes, by exporting a .rewind archive and sending it to them. Use the Export button. To keep secrets out, leave the includeSecrets flag off; the default is to omit them.

Can I run Rewind on a server?

The dev server is designed for a single user on 127.0.0.1. There is no authentication, no team sync, and no per-user isolation. If you want to expose it on a network, you are on your own for hardening.

Can I import my Postman collection?

Yes. Use the Import button's Postman tab. The importer supports Postman Collection v2.1 JSON. Some features — script-based auth, file form-data, mock examples — are not translated. See Importing Postman for the full list.

Can I import an OpenAPI spec?

Yes. Use the Import button's OpenAPI tab. OpenAPI 3.x is supported, in JSON or YAML. The importer converts path parameters, query/header params, JSON examples, and the common security schemes. See Importing OpenAPI.

Can I run a saved collection from a script?

Yes. The apps/api package ships a CLI runner. From the repo root:

bun run cli run <collectionId> --report json

See Running a collection.

Can I script the API directly?

Yes. The full API surface is HTTP, CORS-restricted to the same origin, and protected by a same-site rewind_session cookie set on the first GET. From a script on the same machine, the cookie is automatic when you reuse the same fetch session.

Why does my browser show a CORS error?

If the request goes through Rewind's proxy, the browser doesn't see the cross-origin call at all. If you're getting a CORS error, the dev server is not running, or the request is being made by a different origin. Run bun run dev and check the status bar's API indicator.

Why is the URL bar's "Send" button greyed out?

The URL is empty. Type a URL, or pick a request from the sidebar.

Why does saving fail with a 409?

Another save has happened since you opened the request. Use the conflict dialog's Save as new to make a copy, or Reload stored to drop your changes and pick up the latest version. See Saving and tabs.

Can I have more than one active environment?

No, only one environment is active at a time. The URL bar's environment picker switches the active one.

Where do the response bodies live?

Under the workspace's data directory, in response-bodies/. Each successful response is stored as a separate file. Retention is controlled by the Storage settings. You can clear them by clearing history, or by raising the limit and waiting for the retention pass to re-evaluate.

Can I sync two workspaces?

Not currently. The intended workflow is to export a .rewind archive on one machine and restore it on the other.

Is there a dark mode?

Yes. The theme toggle is in the top bar.

Does the request runner work without the UI?

Yes. The CLI runner is a separate binary that calls the same backend API. It exits with code 0 on success and 1 on any failure, so it slots into a CI pipeline.

How big can my workspace get?

Practically, the limit is disk space. Each request takes a few hundred bytes in the database; each stored response body is up to 50 MB by default. A workspace with 1 000 requests and 1 000 small responses is well under 100 MB.

Why are my OAuth tokens in plain text in the database?

Secrets are flagged in the UI and masked in history and exports, but they're stored as plain text in the database. The database lives in your user account's data directory. If you want at-rest encryption, the right place to add it is in the database layer; see Contributing.

Why does the OpenAPI importer skip my webhook definitions?

Webhooks are a 3.1-only feature and the importer doesn't translate them. You can add the equivalent requests manually.

Why is there no mock server?

The product scope is the local client and proxy; mocking is not included. The collection runner is the closest thing — it executes the saved requests against a real backend. Use a separate tool for mocking.

Why no pre-request or test scripts?

The same scope decision as mocking. Scripts can run inside a CI runner if you need to script behavior; the CLI runner is the supported integration point.

What if I need help that's not here?

Open an issue on GitHub with the output of the diagnostic archive attached.