QA Sessions
One proxy URL, one private override sandbox per person. Your empty cart is your empty cart.
"Who set the catalogue to zero products?"
"I did, for one test, twenty minutes ago."
"I've been debugging that for two hours."
Alice empties her cart. Bob's cart stays full.
You don't have to provision anything. Traffic arrives, FlowMock groups it into sessions, gives each one a readable name and a device icon, and asks you which one is you. Pick your pill — that's your claim, and that's what mocks apply to.
In-product visual
Claiming yourself doesn't narrow what you can see. Watch the whole team's traffic while your own mocks stay active on your own session. Or focus down to just your stream when you want quiet. Two controls, no coupling.
In-product visual
Pick their session and see what they see: their active scenario, the mocks they'd hit, their traffic. Read-only — you can't edit their overrides from view-as, and yours stay hidden from them. When the bug report says "it's broken for me", you can go look.
In-product visual
The honest objection to per-user mocking is "so every tester has to set a header?" No. FlowMock reads the identity your app is already sending.
Pick a primary identity source per project:
| Source | Use it when |
|---|---|
| JWT in the Authorization header | Standard bearer or raw JWT — the common case |
| JWT in a cookie | Browser apps using cookie-based auth |
| JWT in a custom header | Tokens in X-Auth-Token or similar |
| Raw header value | The header value is the identity — API keys, user ids |
| Raw cookie value | Same, from a cookie |
| Query parameter | Identity passed in the URL |
| x-flowmock-session header | Deterministic. The right choice for CI |
| Auto / heuristic only | No explicit source — session cookie, IP and browser fingerprint |
For JWTs, you choose which claims count as identity and in what priority order.
It degrades instead of failing. If the primary source is missing on a request, FlowMock still tries the others — Authorization header, session cookie, IP plus fingerprint — rather than dumping everything into one anonymous bucket. In practice: a tester opens your app, makes one request, and appears in the session list with a readable name and a device icon. Nobody configured anything.
And it's per project, not per person. One setting, chosen once by whoever sets up the project. Your QA team never learns that any of this exists.
| Active scenario | The bundle currently switched on |
|---|---|
| Individual mock activations | One-offs stacked on top |
| Global delay | 500ms / 1s / 3s / 10s on every response — upstream and mocked alike |
| Label | "Testing expired token flow" |
Common objection
Mocks auto-pause after four hours of session inactivity, and the session strip shows the count on every screen. Traffic badges every mocked response. Nobody gets to lose a day to a switch they flipped on Tuesday.
Free plan, no card, two-minute setup.