features

A full-featured API client in one small native binary, without the browser engine or the lock-in.

Request builder

Pick a method, including QUERY (the safe, idempotent, body-carrying method standardized by RFC 10008), then the URL, query parameters, headers and a body: JSON, XML, text, GraphQL, form-urlencoded, multipart or a raw file. A Path tab fills the {name} placeholders in the URL's path (e.g. /bag/{bagId}), and the resolved preview shows the real target. JSON and XML get Validate and Format buttons, and Send doubles as Abort while a request is in flight.

The response viewer shows raw, pretty JSON, XML and HTML (auto-detected), plus headers. It is virtualized, so a multi-megabyte body stays responsive: collapsible nodes, syntax highlighting, find-in-response and a soft-wrap toggle that remembers how you left it. A status line reads like 200 OK · 1.2 KB · 87 ms, Save response to file writes the full untruncated bytes, and a CORS advisory tells you when a browser would have blocked the response.

The Helena app: a collection sidebar, a POST request with a JSON body, and the 201 Created response — A POST with a JSON body and the 201 Created response, next to the collection sidebar.

Authentication, nine schemes

Basic, Bearer, API Key, OAuth 2.0 (client credentials and authorization code with PKCE, with token caching), OAuth 1.0a (HMAC-SHA1), WSSE, AWS Signature v4, HTTP Digest and NTLM (the multi-round Windows handshake). All of them take {{var}} substitution, and credentials stay out of the committed YAML.

Set auth once on a folder or the collection root and requests inherit it; any request can still override it with its own scheme or None. The authentication guide has the details.

Helena's Auth tab set to Bearer Token, with the token sourced from a variable, and a 200 OK response — A Bearer token sourced from {{TOKEN}}: resolved on the wire, never written to disk.

Variables and environments

{{variable}} resolution everywhere (URL, query, headers and body) with a live preview of the resolved URL. Variables resolve through a layered scope chain, so the most specific value wins:

text

global → collection .env → collection → environment
       → folder → request → script overlay

Plus dynamic values like {{$guid}} and {{$timestamp}}, and {{?Name}} variables that ask for a value when you send.

The Helena Headers tab with an Accept and an X-Request-Id header, and a nested JSON response — Request headers with a dynamic {{$guid}}, and a nested JSON response.

Request chaining

A request can declare other requests to run first. Their results are bound as chain.<alias> for the leaf's scripts and templates, so you can log in and then use the token, in a single Send.

Helena's Chain tab: a Place order request that runs Auth/Login first, with the 201 Created order response — "Place order" runs "Auth/Login" first, then reuses its token.

Scripting, tests and assertions

Pre- and post-request JavaScript (on the pure-Go goja engine) with a curated helena.* API: environment access, interpolate, sendRequest, cookie reads, hashing, base64, uuid, date and time helpers, sleep and headless runner control. Check responses with a scripted test() / expect() framework, or with the no-code Assertions tab.

// Post-response script
test("profile looks right", function () {
  expect(response.status).toBe(200);
  expect(response.json.role).toBe("admin");
});

Collections and the headless runner

Organize requests into workspaces, collections and folders. Run a whole collection, or just one folder, from the app, or headlessly with helena run in CI: the same resolution, scripts and assertions as an interactive Send. It exits non-zero on any failure and can write a JSON or JUnit report for CI dashboards.

helena run ./collections/acme --env Staging --format junit > report.xml

HELENA(1)Helena ManualHELENA(1)

ALSO INSIDE

--stream: Real-time: SSE and WebSocket Stream Server-Sent Events into the response view, or open a ws:// or wss:// session with a live two-way transcript. Both are written on the Go standard library, with no third-party network dependency.
--import / --export: Import and export Import OpenAPI 3 (through 3.2, including query and custom-method operations), Swagger 2, WSDL and Postman from a file or URL. Export any request to cURL, wget, fetch, Python requests or Go net/http, or paste a cURL command to build one.
collections.yaml: Storage and privacy Collections, folders, requests and environments are plain Open Collection YAML you can diff and merge like code. Auth secrets and Secret-flagged variables live in a store under your OS config folder, outside the repository, so a committed collection carries no cleartext credential.
--native: Native niceties Light, dark and system themes, request timeout and size limits, SSL and redirect toggles, a cookie jar with a viewer, request history with secrets scrubbed, drag-and-drop ordering, draggable request tabs and keyboard shortcuts (Mod+Enter sends, Mod+S saves).
--offline: No phone-home No account, no telemetry and no background traffic. The only call Helena makes on its own behalf is the update check, and only when you click Check for updates in the status bar.
go test: Plain, testable Go No sandbox to babysit and no surprising magic: the whole runtime is covered by go test, and the non-UI packages hold a 90% coverage floor.

$ helena --download

Try Helena.

Free and open source, for Windows, macOS and Linux. One binary of about 35 MB: no installer, no account and no cloud.

$ helena --download github ↗

features

01 Request builder

02 Authentication, nine schemes

03 Variables and environments

04 Request chaining

05 Scripting, tests and assertions

06 Collections and the headless runner