What ReqBox does today

It’s easy for a product page to blur “what we built” with “what we’re planning.” We’d rather keep those separate — this post is only the first one. Everything below is shipped and working today.

Encrypted collections and requests

Build collections, folders and requests the way you would in any API client — method, URL, query params, headers, body, auth. The difference is invisible until you think about it: every field is encrypted on your device before it’s saved (see Encrypted by default for the details).

Teams and workspaces

A team owns one or more workspaces; workspaces are where collections actually live. Four roles — Owner, Admin, Editor, Viewer — cover the permission levels most teams need without a sprawling custom-roles system to configure.

Realtime sync

Open the same workspace on two machines, or have two teammates working in it at once, and edits show up live. No manual refresh, no “someone else is editing this” conflict dialog to dismiss.

Environments and variables

We shipped this ourselves this week: variables scoped to a workspace (global), a collection, or a specific environment (DEV/QA/PROD-style), with a clear precedence order — environment beats collection beats workspace. Reference a variable anywhere with {{variable_name}}, and it’s color-coded inline by where it resolves from, so you’re never guessing which value is actually going out on the wire. Hover or click a variable to see its resolved value on the spot.

We also ship a set of dynamic variables out of the box — {{$random_uuid}}, {{$timestamp}}, {{$random_int}} and others, always $-prefixed so they never collide with a variable you’ve named yourself — generated fresh every time a request is sent. Type {{$ anywhere and an autocomplete dropdown lists every dynamic variable with a live example of what it’ll resolve to; type {{ on its own and it shows your own stored variables instead, never mixed.

Clicking a dynamic variable shows what it’ll actually resolve to when you hit send.

Pre-request and test scripts

Set a variable from a previous response, or assert that a status code, response time, header or JSON field is what you expect — without leaving the request editor. Pre-request scripts run before the request goes out; a visual test builder lets you add assertions from dropdowns (status code, response time, header, JSON path) with no JavaScript required, and an “Advanced” mode drops down to raw pm.test()/pm.expect() JavaScript for anything the builder doesn’t cover yet.

Every script runs inside its own sandboxed JavaScript engine on your device — no fetch, no filesystem access, no reaching outside the request it’s attached to. It can read and write your environment variables, but nothing else.

Trash and restore

Deleted a request, folder or collection by mistake? It goes to the trash, and you can restore it from there.

Zero-knowledge, even from us

ReqBox is a hosted product — one backend, operated by us. But “hosted” doesn’t mean “readable.” Every field that matters is encrypted on your device before it ever reaches our servers, so what we store and route is ciphertext we structurally cannot decrypt. You don’t have to trust us not to look — we couldn’t if we wanted to.

---

That’s the honest list. Some of it might sound modest compared to tools that have been around for a decade — which is exactly why our next post is about what we haven’t built yet.