Curlew

A local-first API client that can send requests with your live browser session. No account, no cloud, no telemetry.

Curlew is an API client that lives in your browser's side panel — and can send requests using the session you are ALREADY LOGGED INTO. Testing an authenticated endpoint in a normal API client means copying a bearer token or a cookie out of devtools, pasting it into a separate app, and doing it again every time it expires. Curlew is already in the browser where you are already signed in, so there is nothing to copy. Local-first, always: no account, no cloud sync, no telemetry. Everything is stored in IndexedDB on your machine and goes nowhere else. ── USE THE SESSION YOU ALREADY HAVE ── • Borrow the browser's own cookie jar for a host you have granted, including HttpOnly and SameSite=Strict cookies that no external tool can send. • Or write the Cookie header yourself: see every cookie for a host, tick exactly which ones go, and carry another host's session over. • Catch the Authorization and API-key headers a page sends for itself, so you can reuse a short-lived token instead of digging it out of devtools. • Record the requests a granted site makes, then change one header and send it again — the thing the network panel will not let you do. Nothing is granted at install time. You grant one host at a time, from a button, and Chrome itself asks you to confirm. You can revoke from the same place. ── EVERYTHING A REQUEST NEEDS ── • Every method, including ones not in the dropdown. • Query parameters as a synced table — switch one off without deleting it. • Headers with completion, and a warning on the ones browsers will not let an extension set. • Six body types: JSON, text, form-urlencoded, multipart with real files, binary, and GraphQL with a separate variables editor. ── PROVING WHO YOU ARE ── • Bearer tokens, Basic, and API keys in a header or the query string. • OAuth 2 with PKCE — a real browser window, a real consent screen, and a refresh button. • HMAC signatures over a string you describe. • AWS Signature Version 4, for AWS and anything speaking it (MinIO, R2, B2, Spaces). ── READING THE ANSWER ── • A foldable JSON tree, raw bytes, a rendered preview for HTML and images, response headers and cookies. • JSONPath filtering, including recursive search. • A find box that opens folded branches, because a match you cannot see is not a match. • A security lens that reads the response for exposed keys, missing security headers and identifying details. • Generate a TypeScript interface or a Zod schema from any response. • Diff two responses and see only what changed. • Latency profiling with real percentiles — p50, p95, p99 — because an average hides the user who waits three seconds. ── MAKING IT REPEATABLE ── • Collections and nested folders. • Environments and {{variables}}, swapped all at once. • A secret vault: values encrypted with AES-GCM behind a passphrase only you know, derived with 600,000 rounds of PBKDF2. The passphrase is never stored, so it cannot be taken from the database. • Pre-request and post-response scripts with assertions, running in a sandbox with no browser API access. • Run a whole collection in order and see which requests passed. ── CONNECTIONS THAT STAY OPEN ── • WebSocket client with subprotocols, binary frames shown as hex, and a refused handshake explained rather than reported as a bare code. • Server-sent events read with fetch rather than EventSource — so an SSE endpoint gets the same auth, session and variables as every other request. EventSource cannot set a single header, which rules out every authenticated stream there is. • A signed webhook sender for GitHub, Stripe, Slack, Shopify and plain HMAC, so you can test a webhook handler WITH its signature check switched on. A handler tested with that check disabled is a handler whose signature check has never been tested. ── COMING AND GOING ── Reads cURL commands, .http/.rest files, Postman v2.1, HAR, OpenAPI 3 and Insomnia v4. Writes cURL, .http and Postman. A HAR import filters out page assets and tells you how many it dropped. Exports never include a secret value. ── GETTING AROUND ── A command palette on Cmd/Ctrl+K that reaches every command, saved request, environment and recent send by name. Keyboard shortcuts, light and dark themes, and a settings screen for redirects, timeouts and history retention. ── PRIVACY ── • No account. No sign-in. No server of ours — we do not have one. • No telemetry, no analytics, no crash reporting. • Requests go directly from your browser to the host you typed. • Requests, history, collections and variables live in this browser's IndexedDB. Uninstalling removes all of it. • Site access is granted by you, one host at a time, and is revocable.