Guide

Test APIs locally, without a required account

APIWeave is local-first: install the desktop app and build, run, and store workflows with no account at all. This page is specific about what that covers — including the one thing a “stays local” claim usually gets wrong.

Download APIWeave

No sign-up, no backend, no telemetry

What stays put

Three things that never need a server

The desktop app is complete on its own. A git remote adds a copy on a host you choose; it is not a prerequisite for anything on this page.

Your workflows and environments

Workflows, projects, environments, and run history live in a single SQLite database under your OS user data directory. There is no hosted backend for them to live in instead.

Your secret values

Secret values are sealed with a Libsodium sealed box against the install's public key before the write leaves the renderer. The store is write-only: no UI, IPC handler, or MCP tool can read a value back.

Your requests and responses

Requests are sent from your machine over your network, against the environment you selected. Response bodies and run history are never written to a git repository.

Be precise

What does leave your machine

“Local” should mean something checkable, so here is the whole of it.

The API you are testing: A request goes to the host you configured, over your network. That is the point of the tool. Whatever you put in that request — a header, a body field, a resolved secret — reaches that service.
An update check to GitHub Releases: The app checks shortly after launch and every six hours while the window stays open. Set Settings → Updates to Manual only and only the Check for updates button reaches the network.
Git sync, if you connect a remote: One remote repository you choose, such as a private GitHub or GitLab repo. It carries workspace, project, and workflow structure, workspace environments and their plain variables, and the secret references a workflow uses — never secret values, run history, or response bodies.

The distinction that matters

A secret value is never written to a repository — not even for sync, where only the reference travels and a credential typed into a request or a variable is withheld as <SECRET>, or a secret-named header is left out. It is still sent to the API under test when a workflow uses it, because that is what the request is for. The value is sealed at rest, decrypted only in the runtime path, and scrubbed by the masking layer before the run is written to history, so it does not appear in your local run history either.

Secrets

A store that is write-only by construction

A credential you cannot read back is a credential that cannot leak through the app.

{{secrets.NAME}} resolves through a fixed local chain:

  1. the selected environment's secret store
  2. the workspace secret store

First scope that declares the key wins.
There is no third scope.

Write path:
  renderer encrypts with a Libsodium sealed box
    -> ciphertext travels over IPC
      -> main process stores it verbatim

Read path:
  none. The Secrets page shows name, scope, key id,
  and timestamps.

Secrets live at one of two scopes: the workspace, visible to any workflow in it on this machine, or an environment, visible to workflows that select it. The scope is fixed at creation.

Inheritance between environments carries plain variables only. An environment that extends another does not gain access to its base's secrets — the scope chain above is unaffected.

The store is local to one machine and one OS user: keyfile.json is sealed by the OS keychain, so it does not open on another machine. There, set the secrets again; a synced workflow resolves its references against the store of whichever machine runs it.

Network surface

Nothing listens until you ask it to

The app opens no port by default. The one network surface it can offer is a loopback bridge for a local AI agent.

Transport:  Streamable HTTP on a loopback port
Endpoint:   /mcp   on 127.0.0.1
Auth:       Authorization: Bearer <per-install token>
Port:       47271 preferred; a free loopback port
            if that one is taken
Default:    off. Nothing listens until you enable
            the bridge.

It binds to a loopback address only — never a LAN or public address — and every request needs the per-install token.
Browser-originated requests are accepted only from a loopback origin, which protects the endpoint against DNS rebinding.
The tool surface is an explicit whitelist over the same IPC registry the app uses, and it is deliberately smaller than the renderer's.
Secret tools expose names, scopes, and resolution metadata only. They never return a value and cannot mutate a secret.
Run tools return metadata, not payloads. The one exception, runs_getNodeResult, still passes every read through the same secret redaction.

If you connect a remote

A copy on a host you choose, without moving execution

Git sync is plain git against a repository you own. It carries the workspace's files, and it never becomes a place where tests run.

What the repository holds

Workspace, project, and workflow structure
Workspace environments and their plain variables
The {{secrets.NAME}} references a workflow needs

What stays here

Secret values and their ciphertext
Run history and response bodies
User-scoped environments, node presets, and agents

There is no hosted runner: every run happens in the desktop app or in your own CI. When two machines change the same field the app asks which copy to keep rather than overwriting either side. The rest of both sides' changes are already combined.

Local is the default. If you would rather keep a copy on a host, the git sync guide walks through the repository and the credentials.

Connect a git remote Chain requests