RESTK — The Complete Native API Client for macOS & Windows | RESTK📣 Git Sync is here — version your API workspace in git. See how FeaturesGit SyncDocsBlogAboutGet Started

The complete API client. Native speed. Total privacy.<br>Build, test, and debug REST & GraphQL APIs in a fast native app — with 12 auth methods, scripting, environments, and one-click import. Plus the only embedded, privacy-first AI integration.<br>Download for macOSDownload for Windows<br>See how the embedded MCP server works →<br>Security first<br>Not Electron<br>Secrets Stay Local

Native macOS design

Request Builder<br>GraphQL<br>12 Auth Methods<br>Scripting & Tests<br>Import Anything<br>AI / MCP

Everything you expect from a pro API client<br>RESTK is a full-featured native client first. Here is what you will reach for every day.

A request builder that does it all<br>REST and GraphQL in one place. Params, headers, multiple body editors, code generation, and a response viewer with timing, size, and pretty-printing.<br>REST + GraphQL with schema introspection<br>Pretty JSON / XML / HTML response viewer<br>Per-request timeline and searchable history

12 authentication methods, built in<br>OAuth 2.0 with PKCE, JWT, AWS SigV4, Hawk, NTLM, Digest, API Key, Basic, and Bearer — configured per request or inherited from a collection.<br>OAuth 2.0 (PKCE), JWT, AWS SigV4, NTLM, Hawk<br>Inherit auth from collections and folders<br>Variable values never reach AI — secret or not

Scripting and tests with the Nova engine<br>Pre- and post-request JavaScript. Write assertions, transform variables, and get pass/fail reporting — no external runner required.<br>Pre/post-request JavaScript<br>Test assertions with pass/fail reporting<br>Variable manipulation between requests

New — Git SyncYour API workspace belongs in git<br>Everything else you build is in version control. Now your API workspace can be too — requests, environments, folders, and runners, versioned in a repository you own. Commit, branch, and merge, the same way you ship code.<br>Read the Git Sync guideRead the announcement

Review API changes like code<br>Commit and branch your API workspace, then review a change as a readable diff — the same way you review code.

Real merges, a visual resolver<br>When two people edit the same request, RESTK shows both versions side by side to choose from — no hand-editing conflict markers. Renames stay renames; moves keep your work.

Secrets are never committed<br>Mark a value as secret and it stays out of every commit. Teammates see which secrets a workspace expects, never their values — and a secret scan gates every commit and push.

Your repo, works offline<br>Your workspace lives in a git repository you own. RESTK handles the git work from inside the app — no separate client — and commits work with no network at all.

Switch in minutes. Import from anything.<br>Bring your existing work with you. RESTK auto-detects and imports Postman, OpenAPI/Swagger, Insomnia, and cURL — drag, drop, done.

PostmanOpenAPI / SwaggerInsomniacURLRESTK native

Everything You Need From an API Client

Authentication (12 methods)

OAuth 2.0 (with PKCE), JWT, API Key, Basic, Digest, AWS SigV4, Hawk, NTLM, OAuth 1.0, Bearer, Inherited, No Auth

GraphQL

Dedicated editor with schema introspection, autocomplete, variables panel, and operation selection

Scripting & Testing (Nova Engine)

Pre/post-request JavaScript scripts. Test assertions, variable manipulation, pass/fail reporting

Environments & Variables

Multiple environments, {{variable}} substitution, hierarchical resolution, secret variables (never synced, never committed)

Import From Anything

Postman, OpenAPI/Swagger, Insomnia, cURL, RESTK native — auto-detected, drag & drop

Request History

Auto-captured, searchable, restore from history, per-request timeline

Your data. You choose where it lives.<br>Three storage modes, with different trust boundaries. Pick the one that matches what you're working on — and mark any value as a secret to keep it out of all of them.

Local<br>Nothing leaves your machine.<br>No account, no network, fully offline. No infrastructure of ours in the loop.<br>Learn more<br>Git<br>Plain files in a repo you own.<br>Commit, branch, and merge API changes like code, with a visual conflict resolver. Secrets you mark are never committed — teammates see which secrets a workspace expects, never their values. A secret scan gates every commit and push.<br>Learn more<br>Cloud<br>Real-time sync for teams.<br>Auth credentials, header and parameter values, request bodies, and environment variable values are encrypted on your device (AES-256-GCM) before they sync. Your local database is AES-256 encrypted. Sync uses managed encryption.<br>Learn more

LayerProtectionLocal StorageAES-256 encrypted databaseSync TransportAES-256-GCM, encrypted on your device before it syncsKey ManagementManaged encryptionSecretsNever synced, never committed — in any modeAI IntegrationVariable values never sent + credential redactionAccess Control4-tier RBAC (Owner, Manager, Editor, Viewer)UpdatesCryptographically signed

Not Electron. Not a Web...