Generate custom endpoints to capture and inspect HTTP requests.
Sponsored by Formspark, the simple & powerful form solution for developers.
httphq is configured entirely through environment variables.
| Variable | Default | Description |
|---|---|---|
APPLICATION_ENV | development | Set to production to bind all interfaces, raise the rate limit, and default logging to info. |
LOG_LEVEL | env-dependent | Overrides the log level: debug, info, warn, or error. |
PLATFORM | direct | The hosting platform in front of httphq. Selects which header the real client IP is read from (see below). |
httphq derives the client IP (used for rate limiting and shown on captured requests) from the header your hosting platform sets. Declare your platform and httphq picks the right strategy:
PLATFORM | Client IP source |
|---|---|
unset / direct | The TCP connection peer (no proxy). |
cloudflare | CF-Connecting-IP header. |
fly | Fly-Client-IP header. |
heroku | X-Forwarded-For (leftmost). |
render | X-Forwarded-For (leftmost). |
proxy | X-Forwarded-For (leftmost), for a generic nginx / Traefik / load balancer. |
An unrecognised value falls back to direct.
Declaring the platform also strips its vendor-specific headers (e.g.
Cloudflare's Cf-*) from captured requests, so users inspect their own traffic
without the noise of whatever provider sits in front of httphq.
Security note. Setting
PLATFORMtrusts that platform's client-IP header unconditionally: httphq cannot tell a real platform header from one a client forged. You must ensure inbound traffic cannot reach httphq bypassing the platform (e.g. lock your origin to the platform's IP ranges), or a client can spoof its IP and evade rate limiting. Conversely, if you run behind a proxy but leavePLATFORMunset, every request appears to come from the proxy and rate limiting becomes global.