Show HN: Restk – a native API client that stores your workspace as files in Git

The complete API client. Native speed. Total privacy.

Build, test, and debug REST & GraphQL APIs in a fast native app — with 12 auth methods, scripting, environments, and one-click import. Plus the only embedded, privacy-first AI integration.

Download for macOSDownload for Windows

See how the embedded MCP server works →

Security first

Not Electron

Secrets Stay Local

Native macOS design

Request Builder

GraphQL

12 Auth Methods

Scripting & Tests

Import Anything

AI / MCP

Everything you expect from a pro API client

RESTK is a full-featured native client first. Here is what you will reach for every day.

A request builder that does it all

REST and GraphQL in one place. Params, headers, multiple body editors, code generation, and a response viewer with timing, size, and pretty-printing.

REST + GraphQL with schema introspection

Pretty JSON / XML / HTML response viewer

Per-request timeline and searchable history

12 authentication methods, built in

OAuth 2.0 with PKCE, JWT, AWS SigV4, Hawk, NTLM, Digest, API Key, Basic, and Bearer — configured per request or inherited from a collection.

OAuth 2.0 (PKCE), JWT, AWS SigV4, NTLM, Hawk

Inherit auth from collections and folders

Variable values never reach AI — secret or not

Scripting and tests with the Nova engine

Pre- and post-request JavaScript. Write assertions, transform variables, and get pass/fail reporting — no external runner required.

Pre/post-request JavaScript

Test assertions with pass/fail reporting

Variable manipulation between requests

New — Git Sync

Your API workspace belongs in git

Everything else you build is in version control. Now your API workspace can be too — requests, environments, folders, and runners, versioned in a repository you own. Commit, branch, and merge, the same way you ship code.

Read the Git Sync guideRead the announcement

Review API changes like code

Commit and branch your API workspace, then review a change as a readable diff — the same way you review code.

Real merges, a visual resolver

When two people edit the same request, RESTK shows both versions side by side to choose from — no hand-editing conflict markers. Renames stay renames; moves keep your work.

Secrets are never committed

Mark a value as secret and it stays out of every commit. Teammates see which secrets a workspace expects, never their values — and a secret scan gates every commit and push.

Your repo, works offline

Your workspace lives in a git repository you own. RESTK handles the git work from inside the app — no separate client — and commits work with no network at all.

Switch in minutes. Import from anything.

Bring your existing work with you. RESTK auto-detects and imports Postman, OpenAPI/Swagger, Insomnia, and cURL — drag, drop, done.

PostmanOpenAPI / SwaggerInsomniacURLRESTK native

Everything You Need From an API Client

Authentication (12 methods)

OAuth 2.0 (with PKCE), JWT, API Key, Basic, Digest, AWS SigV4, Hawk, NTLM, OAuth 1.0, Bearer, Inherited, No Auth

GraphQL

Dedicated editor with schema introspection, autocomplete, variables panel, and operation selection

Scripting & Testing (Nova Engine)

Pre/post-request JavaScript scripts. Test assertions, variable manipulation, pass/fail reporting

Environments & Variables

Multiple environments, {{variable}} substitution, hierarchical resolution, secret variables (never synced, never committed)

Import From Anything

Postman, OpenAPI/Swagger, Insomnia, cURL, RESTK native — auto-detected, drag & drop

Request History

Auto-captured, searchable, restore from history, per-request timeline

Your data. You choose where it lives.

Three storage modes, with different trust boundaries. Pick the one that matches what you're working on — and mark any value as a secret to keep it out of all of them.

Local

Nothing leaves your machine.

No account, no network, fully offline. No infrastructure of ours in the loop.

Learn more

Git

Plain files in a repo you own.

Commit, branch, and merge API changes like code, with a visual conflict resolver. Secrets you mark are never committed — teammates see which secrets a workspace expects, never their values. A secret scan gates every commit and push.

Learn more

Cloud

Real-time sync for teams.

Auth credentials, header and parameter values, request bodies, and environment variable values are encrypted on your device (AES-256-GCM) before they sync. Your local database is AES-256 encrypted. Sync uses managed encryption.

Learn more

LayerProtection

Local StorageAES-256 encrypted database

Sync TransportAES-256-GCM, encrypted on your device before it syncs

Key ManagementManaged encryption

SecretsNever synced, never committed — in any mode

AI IntegrationVariable values never sent + credential redaction

Access Control4-tier RBAC (Owner, Manager, Editor, Viewer)

UpdatesCryptographically signed

Not Electron. Not a Web App.

Built with native technologies from the ground up. Multi-tab, multi-window, Cmd+P command palette, dark/light themes. Feels like a Mac app because it is one.

Native TechnologiesMulti-TabCmd+P PaletteKeyboard-FirstSparkle Auto-Update

Agents work by reference, not by value

An AI agent sees the shape of your requests and the names of your variables — never the values behind them. Your keys, tokens, and internal URLs stay in the app and are resolved on your machine at send time.

When an agent runs a live request, credentials and secrets are stripped from the response before it reaches the model. Every AI action is logged — the real value next to what the agent actually saw — so you can verify exactly what was sent.

Your API returns:

{ "email": "[email protected]", "api_key": "sk-live-abc123", "balance": 42850.00 }

The agent sees:

{ "email": "[email protected]", "api_key": "[REDACTED]", "balance": 42850.00 }

Note what came through: business data in a response — names, IDs, balances — does reach the agent. That's what lets it reason about the result. If a value shouldn't leave, mark it secret, or use a local workspace.

One exception, and it runs through you: an agent can ask to export a request as cURL with your stored credentials. RESTK stops and asks you to approve, in a dialog that says the agent will see them. An agent can't approve on your behalf — and this is one of the few actions that can't be auto-approved, even if you've enabled auto-approve for everything else.

Values Never SentCredential RedactionLocal MCPAudit TrailCollection Gating

27+ MCP Tools. Zero Configuration.

Connect Claude Code, Claude Desktop, Cursor, or Windsurf in one step. RESTK's embedded MCP server starts automatically and exposes:

Build

Create requests, collections, folders, environments

Execute

Send requests, run cURL, re-execute with overrides

Analyze

Performance analysis, error patterns, schema inference

Test

Generate test scripts, compare responses, assertions

Import

Bring in Postman, OpenAPI, Insomnia, cURL collections

Audit

Every AI action logged — who did what, when

Plus 9 MCP resources and 4 AI prompts. Works with any MCP-compatible client.

Read MCP Docs

How RESTK Compares

FeatureRESTKPostmanBrunoInsomnia

Native AppSwiftElectronTauriElectron

AI IntegrationEmbedded MCP (local)Cloud AIMCP Client only

AI PrivacyNo variable values sentCloud-first

Storage ModesLocal, git, or syncedCloud-firstGit onlyCloud-first

Git WorkflowNative + visual mergeCloud-firstFiles (bring your own git)Built-in (Electron)

Merge ConflictsVisual field-level resolverRaw git markersRaw git markers

Audit TrailBuilt-inEnterprise only

GraphQLFullFullBasicBasic

PriceFree to start$14/moFreeFreemium

Want a detailed breakdown? See the full comparison

The API client built for the AI era.

Native performance. Embedded MCP that never sees your values. Local, git, or synced. Free during beta.

Download FreeBrowse Documentation