Moving from Postman to a web-based API client: what carries over and what to check

If you are looking for a Postman alternative that runs in the browser, the good news is that most of your work can move with you. Swastik Codes reads the public Postman Collection format (v2.0 and v2.1, plus v1 and the newer v3), Postman environment and globals files, and full Postman data dumps. Your pm.* pre-request and test scripts run in a sandbox that implements the documented pm API, so in most collections you import the files, pick an environment and press Send.

This guide covers what carries over, what to check after the move, how to set up a team, and where the two tools differ. It is written for people who already know Postman well and want a realistic picture before they switch, or before they run both side by side.

The short version

1. Export your collections, environments and globals from Postman as JSON (or export a full data dump).
2. Open Swastik Codes, click Import and drop the files in. The format is detected for you.
3. Create a free account so the web app can send requests, then pick an environment and run a request.
4. Run the collection in the collection runner and compare the test results with what you see in Postman.
5. Invite your team to a team workspace with admin, editor or viewer roles.

The step-by-step import itself, including screenshots of each option, is in How to import a Postman collection. The rest of this article is about everything around it.

What carries over

Swastik Codes was built against public, documented formats, so a collection keeps its structure rather than being flattened or approximated.

A few things in a data dump are not imported: header presets, mocks and monitors. When the dump contains any of these, the import preview lists a note such as "mocks in the data dump are not imported". You recreate mocks and monitors in Swastik Codes from the imported collection, which usually takes a minute each.

Scripts and tests

Scripts run in an isolated JavaScript sandbox with time and memory limits. Swastik Codes calls its script API swc; Postman's pm is the same object, so scripts written for Postman run as they are. The API covers the parts real collections use:

• variables: swc.variables, swc.environment, swc.globals, swc.collectionVariables, swc.iterationData, including replaceIn;
• swc.request, swc.response, swc.cookies and swc.info;
• swc.test (and swc.test.skip) with swc.expect and the chai-style swc.response.to.have.status(...), .header(...), .jsonBody(...) and .jsonSchema(...) assertions;
• swc.sendRequest with a callback or as a promise;
• swc.execution.setNextRequest and swc.execution.skipRequest for flow control in runs;
• swc.visualizer.set for custom response views.

Commonly required libraries are available through require, including chai, lodash, moment, crypto-js, uuid, ajv, tv4, xml2js, cheerio and csv-parse/lib/sync, plus Node-style modules such as buffer, url, querystring and util. Older scripts that use the legacy postman.setEnvironmentVariable, tests["..."] = ... and responseBody globals also run.

A typical Postman test script needs no changes:

pm.test("status is 200", () => {
  pm.response.to.have.status(200);
});

pm.test("returns a user with an id", () => {
  const body = pm.response.json();
  pm.expect(body).to.have.property("id");
  pm.environment.set("userId", body.id);
});

pm.* or swc.*

Both names work, so converting is optional. To keep one name across a workspace:

• When importing, leave Convert Postman scripts to swc.* ticked (it is shown when the selected collections contain pm.* scripts). Every collection, folder and request script is rewritten from pm. to swc..
• Later, use Convert pm.* scripts to swc.* in a collection's menu, or Convert to swc.* in the bar shown above a script that uses pm.*.
• When exporting to Postman (v2.1 or v3), scripts are written back with pm., so the collection keeps running in Postman.

The converter reads the JavaScript instead of searching for text: strings, regular expressions, npm, obj.pm and object keys named pm are left alone, and a script that already declares its own swc variable is not touched.

If you want to write new tests, Writing API tests with swc.* scripts walks through the patterns in detail.

Authorization

All the usual auth types are supported: API key, Bearer token, Basic, Digest, JWT, OAuth 1.0, OAuth 2.0 (authorization code with or without PKCE, implicit, password, client credentials and refresh), Hawk, AWS Signature v4, NTLM, Akamai EdgeGrid and ASAP. Auth set on a collection or folder is inherited the same way. For OAuth 2.0 flows in the browser, see OAuth 2.0 in an API client.

What to check after you move

Imports are faithful, but every team has a few habits that are worth a quick look.

1. Variable values that were only "current"

Postman environments distinguish between initial and current values, and an export may or may not include the current ones depending on how it was made. In Swastik Codes, current values of variables are local to your device: they are stripped before anything is stored on the server. That is good for secrets, but it means a token you only ever kept as a current value will not appear for your teammates. Set the initial value for anything the team needs, and keep personal secrets as current values or in the vault.

2. Secrets that should not be shared

Before you put a collection in a team or public workspace, run the secret scanner. It looks for API keys, tokens, passwords and private keys stored as plain text in collections, environments and globals, and it tells you which findings would be exposed through a public workspace or published documentation.

3. Requests to localhost or a private network

This is the most important difference for a web-based client. A browser cannot send arbitrary cross-origin requests, so the Swastik Codes web app sends your requests through the swastik.codes server. That server refuses private, loopback, link-local and reserved addresses. Requests to http://localhost:3000, 192.168.x.x or an internal hostname that resolves to a private IP will fail with an error, even if they work in a desktop client.

For local development, point the request at a publicly reachable staging or preview deployment instead. Or install the desktop app for Windows or Linux, which sends requests from your own machine and reaches localhost and private networks.

4. Scripts that depend on unusual libraries or timing

Scripts that use the common libraries listed above work as written. If a script loads code from a URL with eval, depends on very long setTimeout chains, or relies on a module that is not in the list, check it after the import. The console panel shows script errors with the line that failed.

5. Runner settings

Iterations, delays, data files and "persist variables" exist in the collection runner, and setNextRequest works the way it does in Newman. Re-run your main collection once and compare the pass and fail counts with your last Postman run. Differences usually point at a variable that was never set, which is easy to fix.

Setting up your team

Signing up creates a personal cloud workspace called "My Workspace" that syncs across your devices. For a team:

1. Open the teams dialog and create a team. You become its admin.
2. Invite people by email. Each invite has a role: admin manages the team and its workspaces, editor changes content, viewer reads and runs. Invite links expire after seven days.
3. Create a team workspace and import the shared collections there.

Team workspaces get the collaboration features: comments on requests and collections with @ mentions, version history with restore, forks and pull requests with reviews and merge checks, and an activity feed. Changes from teammates appear live. The collaboration page covers these in more depth.

You can also keep a workspace on your device only. Local workspaces are stored in the browser, are not synced, and are handy for experiments.

What is different

It would not be fair to suggest the two tools are identical, so here is an honest list.

• Where requests come from. In the web app, requests are sent by the swastik.codes server rather than your machine. That removes CORS limits, but it means private and loopback targets are refused, and the target server sees our IP address rather than yours. Postman's desktop app sends from your machine.
• Desktop apps. Swastik Codes runs in the browser, and as a desktop app for Windows and Linux that sends requests from your machine. A macOS version is coming.
• Ecosystem. Postman has a large public network of shared collections, integrations and a long history. Swastik Codes focuses on the client, testing and team workflow.
• Pricing. Swastik Codes is free to use today, with no paid plans. Check Postman's own site for its current plans.
• Protocols. Besides HTTP, Swastik Codes includes GraphQL, WebSocket, Socket.IO, Server-Sent Events, gRPC, MQTT and MCP clients in the same app.

If you depend on a Postman-specific integration or on reaching private hosts directly, keep Postman for those collections and try Swastik Codes for the rest. Nothing stops you from running both: you can export back to Postman Collection v2.1 at any time. A detailed side-by-side is on the Swastik Codes vs Postman page.

A suggested migration plan for a team

1. Pick one collection that the team uses every day and has tests.
2. Import it into a team workspace together with its environments.
3. Run it in the collection runner and fix any differences (usually variables).
4. Recreate mocks and monitors for that collection if you used them.
5. Use it for a week. Leave the Postman copy untouched as a fallback.
6. Move the rest once the team is comfortable, using a data dump if you have many collections.

Frequently asked questions

Will my Postman tests run without changes?

In most cases, yes. The sandbox implements the documented pm.* API, chai-style assertions and the commonly used libraries. Tests that call private network hosts, or depend on modules outside the supported list, need adjusting.

Can I import everything at once?

Yes. Export a data dump from Postman and import it. Collections, environments and globals come across in one go. Header presets, mocks and monitors in the dump are not imported and are listed as notes.

Why can't I reach my localhost API?

The web app sends requests through the swastik.codes server, which refuses private and loopback addresses for security. Use a publicly reachable staging URL, or the desktop app for Windows and Linux, which sends from your machine.

Can I go back to Postman later?

Yes. Export any collection as Postman Collection v2.1 (or v2.0, or v3) and environments in Postman format, then import them into Postman.

Is Swastik Codes free?

Yes, it is free to use today and there are no paid plans.

Try it with your own collection

The fastest way to judge any Postman alternative is with a real collection. Create a free account, open the app and import one. The import and export feature page lists every supported format, and the collection runner is where you check that your tests still pass.