API The API parts of Postman, end-to-end encrypted.
API Partner is a lightweight API client for collections, environments, scripts and teams. Everything you save is encrypted on your device before it syncs, and every request goes straight from your machine to your API — never through ours.
macOS · Windows · Linux · Web · free
Also for · all downloads
Request editor · desktop app
Get API Partner for your desktop.
Native apps for macOS, Windows and Linux — no CORS limits, an encrypted offline cache, and automatic updates. These links always fetch the newest version.
macOS
Apple silicon (M1 and later) or Intel · .dmg
Open the .dmg and drag API Partner into Applications. It's signed and notarised by Apple, so it opens like any other app.
Windows
Windows 10 or 11, 64-bit · installer
Run the setup file. If SmartScreen appears, choose More info → Run anyway.
Linux
x86_64 · AppImage, .deb or .rpm
AppImage: chmod +x, then run it. Or install the
package. Needs libwebkit2gtk-4.1, already on Ubuntu
22.04+ and Fedora 38+.
Prefer not to install anything? Use the web app — same account, same encrypted workspaces. Verify downloads with the SHA-256 checksums.
Everything you open Postman for. Nothing you don't.
API Partner covers the API work: building, sending, testing and sharing requests. It feels familiar from the first minute, and your existing Postman collections come straight across.
Collections, folders, every body type
Organise requests in workspaces, collections and nested folders with drag and drop and draft tabs. Send raw JSON, XML or text, form-data with files, URL-encoded forms or a binary file, with path variables and a rich response viewer.
Environments & variables
Environments, collection variables, globals and dynamic
variables like {{$guid}}. Every
{{variable}} is highlighted, shows its value on
hover, and turns red if it doesn't resolve.
Scripts & tests
Pre-request and post-response scripts at collection, folder and
request level, with a Postman-style ap.* API, Chai
assertions, test results and a console — run in a sandbox with
no file or network access of its own.
Every common auth type
No auth, Basic, Bearer token, API key, Digest and OAuth 2.0 — set once on a collection or folder and inherited by every request below it. OAuth tokens stay on your device.
Import from Postman, cURL, OpenAPI
Bring in Postman v2.1 collections and environments, paste a cURL command, or import an OpenAPI 3 spec. Export back to Postman, cURL, or a native file you can lock with a passphrase.
Teams with roles
Invite teammates by email as owner, admin, editor or viewer. The workspace key is sealed to each member automatically, so sharing never means giving up encryption.
History, favourites, search
Search every request by name, method or URL (method:POST in:Orders), star the ones you use most, and replay anything from history
— which stays on the device that sent it.
Fast, and works offline
The desktop app is native (Tauri and Rust), starts instantly from an encrypted local cache, keeps working offline and syncs your edits when you reconnect. It updates itself, too.
Sign-in done properly
Email with a one-time code, Google or GitHub, passkeys, and authenticator-app MFA with recovery codes. See every signed-in device and sign any of them out.
Move off Postman in four steps.
Create an account
Sign up with email, Google or GitHub, on the web or in the desktop app.
Set your encryption passphrase
Pick an Encryption Passphrase and write down your 24-word Recovery Key. That's what unlocks your data on a new device.
Import your collections
Drop in a Postman export, a cURL command or an OpenAPI spec. It's encrypted on your device before it's synced.
Invite your team
Add teammates by email with a role. They get the workspace key sealed to them and see the same collections straight away.
Your tokens and endpoints are nobody else's business.
Collections are full of secrets: bearer tokens, API keys, internal hostnames, customer payloads. In API Partner, the server that syncs them can't read any of it.
Requests, folders, collections, environments, scripts, examples and workspace names are encrypted with XChaCha20-Poly1305 under a key that belongs to each workspace. The server stores ciphertext and rejects anything else.
Your private key is wrapped with your Encryption Passphrase (Argon2id) and, separately, with a 24-word Recovery Key. Neither ever reaches the server. Changing your passphrase never re-encrypts your data.
The desktop app sends requests natively from your machine; the web app sends them from your browser. There is no proxy, so request and response data never touch our server.
Teammates receive the workspace key sealed to their own public key, and each member shows a safety code you can compare out of band to rule out a swapped key.
History and OAuth tokens are never synced. Your sign-in and keys live in the OS keychain, and the offline cache is encrypted with its own key.
What our server can and can't see
It can see your account (email, username, name), how you sign in, the devices you're signed in on, which workspaces you belong to and with what role, and the shape of your data: how many items there are, their sizes, when they changed and how they're nested.
It can't see any URL, header, parameter, body, script, variable, token, response, or the name of any workspace, collection, folder or request.
Full details are in the privacy policy and the user agreement.
A focused Postman alternative.
API Partner does the part of Postman most teams actually use, and leaves the rest out on purpose — that's what keeps it light.
| Area | In API Partner | Left out |
|---|---|---|
| Requests | REST over HTTP/HTTPS, every body type, path variables, Basic, Bearer, API key, Digest and OAuth 2.0 auth | GraphQL, gRPC and WebSocket clients |
| Organisation | Workspaces, collections, folders, environments, variables, saved examples | API design and versioning |
| Automation | Pre-request and post-response scripts, tests, console | Monitors, scheduled runs, flows |
| Collaboration | Shared workspaces with owner, admin, editor and viewer roles | Comments, public workspaces, published docs |
| Privacy | End-to-end encryption, no request proxy, local-only history | Cloud request proxy, hosted mock servers |
Familiar on day one.
A Postman-like layout, dark by default with a light theme, built from the same design tokens on desktop and web.
01 · Scripts & tests
02 · Environments
Your workspaces are encrypted on this device.
Forgot it? Use your Recovery Key
03 · Unlock on a new device
Straight answers.
What people ask before moving their collections over.
Is API Partner a Postman alternative?
Yes, for the API part of Postman. API Partner covers workspaces, collections, requests, environments, scripts and tests, history and team sharing, and imports Postman v2.1 collections and environments. It deliberately leaves out mock servers, monitors, published documentation and flows.
Can I import my Postman collections?
Yes. API Partner imports Postman v2.1 collections and environments, cURL commands and OpenAPI 3 specs in JSON or YAML. It exports to Postman v2.1, cURL or its own native format, which can be protected with a passphrase.
What does end-to-end encrypted mean here?
Every request, collection, environment, script and workspace name is encrypted on your device with XChaCha20-Poly1305 using a per-workspace key before it is synced. The server stores only ciphertext and never receives the keys, so it cannot read your URLs, headers, tokens or bodies. Teammates get the workspace key sealed to their own public key.
Do my requests go through the API Partner server?
No. The desktop app sends requests natively from your machine, and the web app sends them directly from your browser. Request and response data never pass through the API Partner server, and request history stays on the device that made it.
What happens if I forget my Encryption Passphrase?
Use the 24-word Recovery Key you saved during setup to unlock your data and set a new passphrase. If both the passphrase and the Recovery Key are lost, nobody — including us — can decrypt your workspaces, because the keys never leave your devices unencrypted.
Which platforms does it run on?
A native desktop app for macOS, Windows and Linux, which updates itself, and a web app. Get the desktop app from the downloads above — the page picks the right one for your computer. The Mac App Store, iOS and Android releases are on the way. The web app follows browser rules such as CORS and can't reach every localhost or internal host; the desktop app has no such limits.
How do I install the desktop app?
Download it above — the page picks the
right installer for your computer. On macOS, open the .dmg and
drag API Partner into Applications — it's signed and notarised,
so it opens normally. On Windows, run the setup file; if
SmartScreen appears, choose More info → Run anyway. On Linux,
run the AppImage after chmod +x, or install the
.deb or .rpm. After that the app updates itself.
Can my team share collections?
Yes. Owners and admins invite people by email to a workspace as owner, admin, editor or viewer. The workspace key is sealed to each new member automatically, and every member shows a safety code you can compare to make sure nobody's key was swapped.
Is API Partner free?
Yes. API Partner is free to use today, for individuals and teams. If paid plans are ever introduced, you get at least 30 days' notice and nothing is charged without your agreement.
Who built API Partner, and why?
Shreyansh Jain built it because his team was paying for Postman when all they used it for was sending requests and sharing collections and environments — far too expensive for that. Those collections also held tokens, keys and internal hosts, which is what pushed him to make every workspace end-to-end encrypted.
How do I delete my account?
In the app, open Settings → Security → Delete account and confirm with your password or an emailed code. Your account, keys, sessions and the workspaces only you use are deleted. You can also email shreyansh@shrynshjn.com from the address on your account. The privacy policy has the details.
My team was paying for Postman, and all we used it for was sending requests and sharing collections and environments with each other. That's a lot of money for a small slice of a big product. And those collections held our bearer tokens, API keys and internal hostnames, sitting on a server where someone other than us could read them. So I built the part we actually used, and made sure the server it syncs through can't read a byte of it. API Partner started as our tool; it's open to any team that works the same way.
I've also built SSH Connect, MQTT Connect and Invoice Partner, plus a few other apps — see everything I've made.
Send your first encrypted request today.
Download the desktop app or open the web app, set your passphrase and import a Postman collection — it takes about two minutes.