Hoppscotch self-hosted: which features require a backend in production behind a reverse proxy?

Answer

In a production deployment that serves the Hoppscotch web build through a reverse proxy, the following features can work without a backend:

• Basic HTTP request/response testing – the browser sends requests directly to target APIs.
• Local collections, environments, and history – stored only in localStorage or IndexedDB.
• Pre‑request and test scripts – executed entirely in the browser sandbox.
• OAuth 2.0 / OIDC flows that use the “authorization code with PKCE” pattern and do not require a client‑secret exchange.

Features that require a self‑hosted backend (or a proxy that forwards to one) include:

• Real‑time collaboration (multi‑user editing, live cursors, shared collections) – needs a WebSocket/SSE server and sticky sessions.
• Environment/collection sync across devices and team workspaces – relies on the REST API and database.
• OAuth flows that need a confidential client or token refresh via a server‑side endpoint.
• Webhook receivers and callback endpoints – inbound HTTP listeners.
• Role‑based access control, audit logs, and enterprise features – all backend‑only.

Verification Steps

1. Deploy the official docker-compose.yml but comment out the backend, redis, and postgres services.
2. Set the following environment variables for the frontend service:
   • VITE_API_BASE_URL=""
   • VITE_WS_BASE_URL=""
3. Start the container and access the UI through the reverse proxy.
4. Open the browser devtools Network tab and confirm that requests to /api/v1/*, /ws, or /sse fail (indicating those features are disabled).
5. Try sending a request to a public API (e.g., https://httpbin.org/get) – it should succeed.
6. Attempt an OAuth flow with a provider that supports PKCE only. If the redirect URI is the frontend origin, the flow should complete without a backend.
7. Open two tabs of the same collection and verify that changes do not propagate – real‑time collaboration is absent.

What to Check in Your Release

Feature availability can shift between releases. Inspect the release’s .env.example and the frontend’s src/config/env.ts for flags such as:

• ENABLE_REALTIME_COLLABORATION
• ENABLE_SYNC
• ENABLE_OAUTH_PROXY

Also verify that your reverse proxy forwards Upgrade and Connection headers for WebSocket connections, and that sticky sessions or a shared Redis store are configured if you enable collaboration.

Ask for Missing Detail

Do you need real‑time collaboration or OAuth flows that involve a client secret? If so, a backend service is required.