Sling

An HTTP client for Windows where the request is a text file, not a form.
Write requests in plain .http files, press Ctrl+Enter, and read the response in a real editor.

Download for Windows · Quick start · Features · Shortcuts · Docs · FAQ

---

What is Sling?

Sling is a desktop app for calling HTTP APIs, like Postman or Insomnia, with one big difference: your requests are text files in the standard .http format that Visual Studio, JetBrains Rider and the VS Code REST Client already understand.

@base = https://api.example.com

### Log in
# @name login
POST {{base}}/auth
Content-Type: application/json

{ "user": "ada", "password": "{{password}}" }

### Who am I? The token comes from the response above
GET {{base}}/me
Authorization: Bearer {{login.response.body.$.access_token}}

That file is the whole collection. Put it in your repository and your team gets:

• Requests you can review. A change to an API call shows up as a normal diff in a pull request.
• Collections that are just folders. Grouping is ###, hierarchy is directories, sharing is git push.
• No lock-in. Uninstall Sling tomorrow and every request still opens in your IDE.
• No account, no cloud, no sync, no telemetry. Nothing leaves your machine except the requests you send, and an update check if you allow one.

Quick start

1. Download Sling-Setup.exe and run it. It installs for your user only, so there is no admin prompt.
2. Open a folder with Ctrl+Shift+O. Any folder works: an empty one, or a repository that already has .http files in it.
3. Write a request, or click + Request:

   GET https://api.github.com/repos/dotnet/runtime

4. Press Ctrl+Enter (or Send). The response opens on the right, formatted and highlighted.

Coming from Postman? Press Ctrl+I to import a collection, environments included. Got a curl command? Paste it into the request pane and it becomes a request.

Features

Collections without a collection format

The rail on the left is your folder: collections are directories, files are .http documents, and each ### block inside a file is a request, with its verb colour-coded. Click a request to show it on its own, or All requests to see the whole file. Sling stores nothing to draw the tree, so renaming a collection is renaming a folder. More about collections →

Chain requests together

Name a request with # @name, then pull any value out of its response with JSONPath: {{login.response.body.$.access_token}}. Sending a request that depends on another sends the dependency first, automatically. Run all (Ctrl+Shift+Enter) sends every request in the file, and the picker beside the response lets you step through each exchange.

Environments and secrets, kept apart

Switch between dev, staging and prod from the picker above the request. Values live in http-client.env.json, which you commit, and secrets live in http-client.private.env.json, which Sling adds to your .gitignore for you. These are the same files Rider and Visual Studio use, so existing environments work unchanged. Press Ctrl+E to edit them without hand-writing JSON. More about environments →

Find anything with Ctrl+P

Quick open searches every request in the folder by collection, file name, request name, verb and URL. Every word you type has to match somewhere, so post orders and orders staging both find what you mean.

It notices when the file changes underneath you

A .http file lives in git, so a pull, a branch switch or another editor can change it while it is open. Sling spots that the moment you come back and offers Reload, Keep mine or Compare, and it will not save over a version you have not seen.

And the rest

A response you can work with	The body lands in a real editor buffer: highlighted, foldable, searchable with Ctrl+F. Right-click to format JSON, decode base64 or a JWT, and chain transforms.
Auth that is not a mystery	Ctrl+Alt+A shows which credential a request sends and where it comes from. OAuth 2.0 client credentials and authorization code with PKCE are built in, and tokens refresh on a 401. Auth docs →
Postman import	Collections and environments come across in one step, and no credential is ever written into a .http file. Import docs →
curl paste	Paste a curl command and get a request. Anything that cannot be expressed becomes a comment saying what was dropped. curl docs →
File and multipart bodies	< ./payload.json sends a file; <@ ./template.json fills in {{variables}} first.
Cookies	A cookie jar per environment, so a staging cookie can never reach production.
History	Ctrl+H shows what you sent and what came back, with credentials redacted and no bodies stored. History docs →
Picks up where you left off	The last folder, file, caret and pane sizes come back when you reopen Sling.
Completion	Ctrl+Space completes directives, headers and variables.

Keyboard shortcuts

Everything is also a button, and every button's tooltip names its shortcut.

Shortcut	Action
Ctrl+Enter	Send the request under the caret
Ctrl+Shift+Enter	Send every request in the file
Esc	Cancel the run, or close a panel
Ctrl+P	Go to a file or a request
Ctrl+O / Ctrl+Shift+O	Open a file / a folder
Ctrl+S / Ctrl+Shift+S	Save / save as
Ctrl+N	New document
Ctrl+Shift+N	Add a request to the open file
Ctrl+I	Import a Postman export
Ctrl+B	Show or hide the collections rail
Ctrl+F	Find, in either pane
Ctrl+Space	Complete a directive, header or variable
Ctrl+Alt+A	Auth for this request
Ctrl+E	Environments and secrets
Ctrl+H	History
Ctrl+,	Settings

Sling or Postman?

Sling is for developers who already find Postman heavier than the job: the people with a scratch collection called "test" who have thought about going back to curl.

	Sling	Postman
A request is stored as	A few lines of text in a .http file	An entry in a large collection JSON export
Reviewing a change	A normal diff in a pull request	Hard to read in a diff
Opens in VS, Rider, VS Code	Yes, same format	No
Account or cloud needed	No	Built around a synced workspace
Scripting, test assertions, mock servers	No, deliberately	Yes

If you live in Postman's Tests tab, collection runner or mock servers, Sling is not trying to replace that. It covers what most people actually use an API client for, as files you own.

Security

Sling handles credentials, so these are rules, not options:

• Secrets live in a separate, gitignored file, and imports never write a literal credential into a .http file.
• Authorization, Cookie and Proxy-Authorization are dropped when a redirect crosses origins.
• TLS validation is on by default.
• Stored tokens are encrypted with Windows data protection under your account, scoped per folder and environment. No client secret is written to disk.
• History redacts credentials and stores no request or response bodies.
• Responses render as text, never in a browser control.
• No telemetry and no crash upload. The update check is opt-in: Sling asks the first time, and if you say yes it asks api.github.com once a day for the newest release, carrying Sling's version and nothing else. Nothing is downloaded until you press Update, and the installer must match the SHA-256 GitHub publishes before it runs. Change the answer, or check by hand, in Settings.

Download

Sling-Setup.exe	The latest release. One installer for both x64 and arm64.
Sling-Setup.exe from master	The newest build of master. It is only replaced when the test suite passes, so a broken commit never reaches it.

The installer is per-user: no admin rights, no UAC prompt, nothing running at startup. It installs to %LOCALAPPDATA%\Programs\Sling and adds Sling to Open with for .http and .rest files. Making Sling the default for those files is an unticked option, because your IDE probably owns them already.

Sling is not code-signed yet, so Windows SmartScreen will warn you the first time. If you would rather not click through that, build it yourself.

Documentation

Guide	What it covers
The .http dialect	Everything Sling reads, and where it differs from the VS Code REST Client
Collections	How the rail maps to folders and files
Environments	The two environment files, $shared, and precedence
Auth	Bearer, basic, OAuth 2.0, token storage and refresh
Postman import	What comes across, and what cannot
curl import	The paste rules and the flags it refuses
History	What is recorded and what redaction catches
Etch.Core package	The one extra build step, and why

FAQ

Will my requests work in other tools? Yes. .http is the format Visual Studio 2022, Rider and the VS Code REST Client read. Sling's few extensions are listed in the dialect guide.

Where are my requests stored? Wherever you put them. Sling opens a folder and reads the .http files in it. The only things it keeps for itself (history, the last session, encrypted tokens) are in %LOCALAPPDATA%\Sling, never in your repository.

Does it run on macOS or Linux? No. Sling is a native Windows app built on WPF.

Can I run scripts or write tests? No, by design. A scripting runtime is what turns a request file back into something only one tool can run.

Is it free? Yes, to download and use for anything, including at work. See Licence.

Building from source

You need the .NET 10 SDK and a checkout of Etch next to this one, because Sling uses Etch.Core from a private package feed. Why, and how to authenticate instead →

dotnet pack ../Etch/src/Etch.Core/Etch.Core.csproj -c Release -o local-feed

dotnet build Sling.slnx

dotnet test Sling.slnx

Building the installer

Needs Inno Setup on the PATH. Publish both architectures, then pack:

dotnet publish src/Sling.App/Sling.App.csproj -c Release -r win-x64 --self-contained true -p:PublishSingleFile=true -p:PublishReadyToRun=true -p:Version=1.0.0 -o publish/win-x64

dotnet publish src/Sling.App/Sling.App.csproj -c Release -r win-arm64 --self-contained true -p:PublishSingleFile=true -p:PublishReadyToRun=true -p:Version=1.0.0 -o publish/win-arm64

iscc installer\Sling.iss /DAppVersion=1.0.0 /DNumericVersion=1.0.0

Sling-Setup.exe lands in dist/. The release workflow runs exactly these commands.

Project layout

Project	Contains
Sling.Core	The .http parser, models, variable and chain resolution, redaction. No I/O, no network.
Sling.Import	Postman v2.1 and curl to .http.
Sling.Http	The only project that touches the network.
Sling.Persistence	All disk I/O.
Sling.App	The WPF shell (WPF-UI and AvalonEdit).

The boundaries are enforced by ArchitectureTests, not just documented.

Licence

Source-available, not open source. Sling is free to download, read, build and run, for anything, including commercially. You may not modify it, republish it or sell it. See LICENSE for the terms, and THIRD-PARTY-NOTICES.md for the components it is built on.

Your request files, and everything you send and receive with Sling, are yours.