Porticol

Auth and transport

Auth schemes

A request, a folder or a collection can use:

A request with no auth of its own uses its folder's, and a folder with none uses the collection's.

For OAuth 2.0, Porticol opens your browser to sign in and takes the answer on a loopback address, with PKCE. It also does the client credentials and password grants. Tokens are kept in your keychain, never in history, and refreshed before they expire when you send.

Transport settings

A request, a folder and a collection each have a Settings section. Like auth, a setting left unset is taken from the folder, then the collection, then Settings > Requests.

Setting What it does
Timeout Seconds before an unanswered request is given up on. The default is 30.
Follow redirects Whether a 3xx response is followed to what it points at.
TLS verification Whether the server's certificate is checked against the trust store.
Client and CA certificates Which certificates to present and to trust for this request.
Proxy None, the system's proxy settings, or a proxy URL.
HTTP version Which version to ask the connection for, or Auto.
Retries How many attempts to make, and how long to wait before the first retry.

When verification is on and a server's certificate fails it, the response says why and offers to turn verification off for that request alone.

The System proxy reads your operating system's settings when you send: on macOS the network settings, on Windows the Internet and WinHTTP settings, and on Linux the proxy environment variables and the GNOME and KDE settings. Proxy auto-config (PAC) files and bypass lists, NO_PROXY among them, are honoured, and loopback addresses always go direct. A team server ignores System and uses the proxy its administrator set.

Certificates

The certificate manager holds client certificates to present and CA certificates to trust, each for the hosts that match a pattern. Open it from Settings > Certificates and cookies, or choose Open certificate manager in the command palette.

Add a client certificate as PEM files, or as a .p12 or .pfx file with its password. Its private key goes into your keychain. A certificate a request's own settings name is used only for that request's host, so a redirect elsewhere doesn't carry it.