The complete API client. Native speed. Total privacy.
Build, test, and debug REST & GraphQL APIs in a fast native app — with 12 auth methods, scripting, environments, and one-click import. Plus the only embedded, privacy-first AI integration.
Native macOS design
Everything you expect from a pro API client
RESTK is a full-featured native client first. Here is what you will reach for every day.
A request builder that does it all
REST and GraphQL in one place. Params, headers, multiple body editors, code generation, and a response viewer with timing, size, and pretty-printing.
- REST + GraphQL with schema introspection
- Pretty JSON / XML / HTML response viewer
- Per-request timeline and searchable history
12 authentication methods, built in
OAuth 2.0 with PKCE, JWT, AWS SigV4, Hawk, NTLM, Digest, API Key, Basic, and Bearer — configured per request or inherited from a collection.
- OAuth 2.0 (PKCE), JWT, AWS SigV4, NTLM, Hawk
- Inherit auth from collections and folders
- Variable values never reach AI — secret or not
Scripting and tests with the Nova engine
Pre- and post-request JavaScript. Write assertions, transform variables, and get pass/fail reporting — no external runner required.
- Pre/post-request JavaScript
- Test assertions with pass/fail reporting
- Variable manipulation between requests
Your API workspace belongs in git
Everything else you build is in version control. Now your API workspace can be too — requests, environments, folders, and runners, versioned in a repository you own. Commit, branch, and merge, the same way you ship code.
Commit and branch your API workspace, then review a change as a readable diff — the same way you review code.
When two people edit the same request, RESTK shows both versions side by side to choose from — no hand-editing conflict markers. Renames stay renames; moves keep your work.
Mark a value as secret and it stays out of every commit. Teammates see which secrets a workspace expects, never their values — and a secret scan gates every commit and push.
Your workspace lives in a git repository you own. RESTK handles the git work from inside the app — no separate client — and commits work with no network at all.
Switch in minutes. Import from anything.
Bring your existing work with you. RESTK auto-detects and imports Postman, OpenAPI/Swagger, Insomnia, and cURL — drag, drop, done.
Everything You Need From an API Client
Authentication (12 methods)
OAuth 2.0 (with PKCE), JWT, API Key, Basic, Digest, AWS SigV4, Hawk, NTLM, OAuth 1.0, Bearer, Inherited, No Auth
GraphQL
Dedicated editor with schema introspection, autocomplete, variables panel, and operation selection
Scripting & Testing (Nova Engine)
Pre/post-request JavaScript scripts. Test assertions, variable manipulation, pass/fail reporting
Environments & Variables
Multiple environments, {{variable}} substitution, hierarchical resolution, secret variables (never synced, never committed)
Import From Anything
Postman, OpenAPI/Swagger, Insomnia, cURL, RESTK native — auto-detected, drag & drop
Request History
Auto-captured, searchable, restore from history, per-request timeline
Your data. You choose where it lives.
Three storage modes, with different trust boundaries. Pick the one that matches what you're working on — and mark any value as a secret to keep it out of all of them.
No account, no network, fully offline. No infrastructure of ours in the loop.
Learn moreCommit, branch, and merge API changes like code, with a visual conflict resolver. Secrets you mark are never committed — teammates see which secrets a workspace expects, never their values. A secret scan gates every commit and push.
Learn moreAuth credentials, header and parameter values, request bodies, and environment variable values are encrypted on your device (AES-256-GCM) before they sync. Your local database is AES-256 encrypted. Sync uses managed encryption.
Learn more| Layer | Protection |
|---|---|
| Local Storage | AES-256 encrypted database |
| Sync Transport | AES-256-GCM, encrypted on your device before it syncs |
| Key Management | Managed encryption |
| Secrets | Never synced, never committed — in any mode |
| AI Integration | Variable values never sent + credential redaction |
| Access Control | 4-tier RBAC (Owner, Manager, Editor, Viewer) |
| Updates | Cryptographically signed |
Not Electron. Not a Web App.
Built with native technologies from the ground up. Multi-tab, multi-window, Cmd+P command palette, dark/light themes. Feels like a Mac app because it is one.
Agents work by reference, not by value
An AI agent sees the shape of your requests and the names of your variables — never the values behind them. Your keys, tokens, and internal URLs stay in the app and are resolved on your machine at send time.
When an agent runs a live request, credentials and secrets are stripped from the response before it reaches the model. Every AI action is logged — the real value next to what the agent actually saw — so you can verify exactly what was sent.
{
"email": "[email protected]",
"api_key": "sk-live-abc123",
"balance": 42850.00
}{
"email": "[email protected]",
"api_key": "[REDACTED]",
"balance": 42850.00
}Note what came through: business data in a response — names, IDs, balances — does reach the agent. That's what lets it reason about the result. If a value shouldn't leave, mark it secret, or use a local workspace.
One exception, and it runs through you: an agent can ask to export a request as cURL with your stored credentials. RESTK stops and asks you to approve, in a dialog that says the agent will see them. An agent can't approve on your behalf — and this is one of the few actions that can't be auto-approved, even if you've enabled auto-approve for everything else.
27+ MCP Tools. Zero Configuration.
Connect Claude Code, Claude Desktop, Cursor, or Windsurf in one step. RESTK's embedded MCP server starts automatically and exposes:
Build
Create requests, collections, folders, environments
Execute
Send requests, run cURL, re-execute with overrides
Analyze
Performance analysis, error patterns, schema inference
Test
Generate test scripts, compare responses, assertions
Import
Bring in Postman, OpenAPI, Insomnia, cURL collections
Audit
Every AI action logged — who did what, when
Plus 9 MCP resources and 4 AI prompts. Works with any MCP-compatible client.
How RESTK Compares
| Feature | RESTK | Postman | Bruno | Insomnia |
|---|---|---|---|---|
| Native App | Swift | Electron | Tauri | Electron |
| AI Integration | Embedded MCP (local) | Cloud AI | MCP Client only | |
| AI Privacy | No variable values sent | Cloud-first | ||
| Storage Modes | Local, git, or synced | Cloud-first | Git only | Cloud-first |
| Git Workflow | Native + visual merge | Cloud-first | Files (bring your own git) | Built-in (Electron) |
| Merge Conflicts | Visual field-level resolver | Raw git markers | Raw git markers | |
| Audit Trail | Built-in | Enterprise only | ||
| GraphQL | Full | Full | Basic | Basic |
| Price | Free to start | $14/mo | Free | Freemium |
Want a detailed breakdown? See the full comparison
The API client built for the AI era.
Native performance. Embedded MCP that never sees your values. Local, git, or synced. Free during beta.