One scenario format for testing internal and public APIs — LB, direct IP, or hostname — with secrets resolved securely at run time, not hardcoded.
INSTALLloadcannon examples --write scenariosPulls the bundled example files onto disk — the binary alone doesn't come with any.
cp scenarios/example-public-https-domain.json my-api.jsonPick whichever example matches your target (see the full set below), then edit my-api.json: the URL, auth, and endpoint paths.
loadcannon validate --scenario my-api.jsonResolves auth and fires one request. Confirms the config is right before spending VU-minutes on it.
loadcannon run --scenario my-api.jsonGenerates the k6 script, runs it, writes loadcannon-out/report.html.
open loadcannon-out/report.htmlRead the results. Re-run loadcannon --help any time for this same sequence.
Needed by the AWS CLI to open SSM port-forwarding sessions. Install guide →
Plain hostname, HTTPS or HTTP. No network prerequisites.
Run from a host on the VPN/VPC, or tunnel in via tunnel-ssm.sh.
Bypasses DNS/round-robin to hit one node, SNI and Host header still correct.
Resolves auth and fires one baseline request before you spend VU-minutes on a broken config.
Generates a k6 script, executes it, renders an HTML report from the summary.
Emit the script without running it — hand off to a CI runner or another engineer.
Reach a private-subnet target via IAM-authenticated SSM port forwarding. No VPN, no open ports.
Every one of these hits a real, public, always-on API — run loadcannon validate or loadcannon run against any of them right now, no account or real credentials needed. Raw JSON from main: right-click → Save As, or curl directly. Same six files loadcannon examples --write scenarios gives you. Their thresholds are set loose on purpose — these are free, shared, community-run services with no latency SLA, so an occasional breach reflects their infra, not loadcannon. Tighten the numbers once you swap in your own target.
Hits jsonplaceholder.typicode.com — a free fake REST API built for exactly this. No auth required. raw →
Hits httpbin.org over plain HTTP — a public HTTP-debugging service, no signup or API key. raw →
Hits Cloudflare's 1.1.1.1 directly by IP with a Host-header override — a real, permanently stable public IP, so this demonstrates the direct-IP pattern without needing an internal target. raw →
Uses httpbin.org/bearer as a public stand-in for an internal LB endpoint — it accepts any non-empty bearer token, so it exercises the full auth-resolution path (token_source: env) before you point it at a real internal service. Set DEMO_TOKEN to literally anything. raw →
Uses Google's 8.8.8.8 as a public stand-in, host-override + direct IP, no auth — the pattern for an unauthenticated internal healthcheck hit directly, bypassing the LB. raw →
Not a live demo — copy this per new internal service. Won't parse until you delete its _comment field, so it can't run by accident. raw →
Full scenario schema, secret-source options (env / file / ssm / prompt), and release process: github.com/yousafkhamza/loadcannon