Sign in

New service

01 Destination

Hostname: —
Use http:// or https://

02 Access policy

03 Access tokens

Configure independent allowed carriers per token. Any one valid token in any allowed location grants access, even if another key is invalid.

Token values are stored as plaintext in YAML and appear unredacted in access logs. Protect both files and backups.

04 Cross-origin requests (CORS)

Preflight requests are answered directly by Popy in All and Rules modes. Actual protected requests still require a valid token.

05 Path processing

Rewriting runs after Popy credential-path stripping, before the upstream URL base path is joined. Query strings are unaffected.

06 Upstream request overrides

Replace matching request fields and add missing ones before forwarding. One name and literal value per line; no templates or expressions.

07 Upstream response overrides

Replace target response headers and named cookies, keeping all other fields unchanged. Values are stored verbatim in YAML.

Request details

This record may contain live authentication credentials and cookies.