API Toolbox
Your API client, in your pocket. A native mobile REST and GraphQL client with Postman-style collections, environments and a secrets vault.
- Role
- Design, app & backend
- When
- 2026
- Platforms
- Android · iOS
- Status
- In testing
Overview
API Toolbox brings the core Postman workflow to your phone: saved collections, environments with {{variables}}, auth helpers, and cURL and Postman import/export. You can hit a real API from wherever you are, without a laptop.
It's built for developers away from their desk: on-call engineers checking production, mobile developers replaying a request from the device that sees the bug, QA testers repeating login → token → call flows, and self-hosters poking LAN APIs. It sends real HTTP with no CORS proxy, and secrets never leave the device.
The free tier never limits the core request tool. Pro adds unlimited storage, cloud history, code generation, a collection runner, API docs export and collection sharing.
What it does
Paste a cURL, hit send
Import any cURL command and share any request back out as cURL.
Full request editor
All methods, params, headers, JSON, form and GraphQL bodies, with multi-request tabs.
Rich responses
Status, timing and size, pretty JSON, search, JSONPath queries and response diff.
Environments & variables
Switch dev → staging → prod with one chip. Imports Postman environments.
Auth helpers
Bearer, Basic, API key and OAuth2 client credentials.
Secrets vault
{{secret:name}} values live in the phone keychain and never touch the cloud.
Collection runner
Runs requests in order, passes JSONPath captures between them and checks assertions.
Code generation
cURL, fetch, axios, Node, Python, Dart, Go, PHP and Java OkHttp.
Sync & sharing
Collections sync across devices and work offline. Share them with view/edit roles via invite codes.
Engineering highlights
Three-scope variable resolution
Run-scope captures override environment variables, while {{secret:…}} values resolve only from the device keychain, namespaced per user so a second account on the same phone can't read them.
Collection sharing with no backend code
Invite documents plus Firestore security rules validate the code, its expiry and the role being claimed, which keeps the app on Firebase's free plan.
Two-way Postman compatibility
Postman v2.1 import/export preserves nested folder order and recovers orphaned items. A cURL parser and a 9-target code generator are all unit-tested.
Freemium done fairly
Limits are enforced in the repository layer and the Pro flag is mirrored from RevenueCat. Users who downgrade keep all their data.
Tech stack
- Flutter
- Dart
- Firebase Auth
- Cloud Firestore
- RevenueCat
- dio
- Secure Storage
- Codemagic
- GitHub Actions