Flutter network inspector

xRay shows every network call your Flutter app makes, live, in a desktop app next to your editor. Headers, bodies, status codes, sizes and timing, for Dio, package:http and any other client built on dart:io.

Capture every HTTP call with one line

Turn on the HTTP override and xRay records every request made through dart:io, without changing your clients:

final networkInspector = XRayNetworkInspector(enableHttpOverride: true);

Using Dio? Attach the interceptor as well, and xRay also records the requests another interceptor answers or rejects, for example from a cache:

XRayNetworkDioInterceptor.attach(dio, inspector: networkInspector);

Calls from background isolates can be recorded too. The network inspection guide has the full setup.

More than REST

• GraphQL Operations show by name, and an error returned with a 200 is marked as an error.
• WebSockets Every message as it arrives, in both directions.
• Protocol Buffers and gRPC-web Bodies decoded with your own .proto files, message by message.
• Serverpod Calls show by endpoint and method, with the xray_serverpod_interceptor package.

Find the call that broke

Filter by method, status, host, response type, duration and size, search in URLs, headers and bodies, or use presets such as Errors only and Slow > 1s. See each call on the timeline next to the logs and storage changes around it. Open several apps or devices in tabs, for example the iOS and Android build side by side.

Share it with the team

Copy a call as cURL or Markdown, or export the whole session as a .xray file or as a HAR, which opens in browser developer tools and many other tools. A tester can attach it to a ticket, and the developer sees exactly what the app sent.

Tokens stay hidden

Authorization, Cookie, Set-Cookie, X-Api-Key and other credential headers are masked inside your app before a call is stored, so they never reach a connected desktop or an export. The masked value keeps its last 4 characters, so you can still tell two tokens apart. Choose your own list of headers with redactHeaders.

Only in debug builds

The inspector does not start in release or profile builds. Connections are encrypted and need a pairing code, a team password or a trusted desktop, so nobody else on the office Wi-Fi can read your traffic.