macOS · Windows · native
The API client that
doesn't eat your laptop.
Impostor is a lightweight, fast, local API client with a Rust core — full HTTP, every auth scheme, scripting, WebSocket, SSE, gRPC and MCP. It idles in tens of megabytes, where Electron-based clients like Postman sit in hundreds.
No account required. Git-friendly, secrets encrypted at rest.
Approx. idle memory — lower is better. *
Built the way an API client should be
We wanted an API client, not a browser wearing a trench coat — so we built one that's light, lean, and secure by design, for people who keep it open all day.
Light on memory
Idles in tens of megabytes where Electron-based API clients sit in hundreds — a Rust core in your OS-native webview, not a bundled Chromium browser shipped with a form.
Performant by design
Cold-starts like the native app it is, stays responsive under load, and doesn't balloon while it runs — open it, send a request, move on.
Lean by design
No bloat, no AI slop, no upsell nag, no account wall. Just the API workspace you reach for, doing its job and staying out of your way.
Sovereign & secure by design
Defence in depth, and your data in datastores you control — never our storage. Secrets stay encrypted on your device. Nothing phones home.
Everything you reach for, built in
REST, GraphQL, WebSocket, SSE, gRPC and MCP in one API client — no plugins to bolt on, no paywall between you and the protocol you need.
Part of your agentic workflow
Connect your AI tool — Claude, Cursor, Copilot — to Impostor's MCP server and make your API workspace part of your agentic loop. It targets the workspace you have open, with secrets redacted, scripts never run, and access jailed to that folder.
Full HTTP & every auth scheme
Every method, params, headers, and bodies (raw, form, multipart, binary), with gzip/brotli, redirects, timeouts, and a cookie jar. Auth for all of it: API key, Bearer, Basic, Digest, AWS SigV4, OAuth 2.0 (PKCE), and mTLS.
Scripting & tests
Pre/post-request JavaScript with an im.* API — variable extraction, assertions, and chaining, sandboxed and fast.
WebSocket · SSE · gRPC · MCP
A live WebSocket console, Server-Sent Events, a dynamic gRPC client (server reflection or .proto), and an MCP client to explore tools, resources, and prompts.
Collection runner & CLI
Run a folder end-to-end, chain values, iterate over a data file, and download a shareable HTML report — or drive requests headless from the impostor CLI, in scripts and CI.
Git-friendly & team sync
Workspaces are flat YAML — one request per file, clean diffs. Clone, commit, pull, push, and review a semantic diff from the built-in Source Control panel. Share a repo, not a cloud account.
Coming from Postman?
Switching API clients shouldn't mean rebuilding a year of work. Bring the collections and the scripts you already have, and pick up where you left off.
Bring your collections
Import Postman v2.1 collections and environments — several exports at once, auto-detected — with auth, bodies, and scripts intact. Or paste a cURL command and get a request.
Keep your scripts
Pre- and post-request scripts run against an im.* API that is Postman pm.* compatible, so your existing tests, assertions, and chaining come across as they are.
Keep your data
Nothing is uploaded to sign up or sync. Your workspace lands on disk as flat YAML you can commit, and secrets stay encrypted in your OS keychain.
Approximate figures for the same workspace of 100 requests, 5 of them freshly run; memory usage from Task Manager / Activity Monitor.