Everything Retriever does.

The complete feature list for the native Mac API client, grouped the way you'll look for it. If something you need isn't here, check what's not in yet or ask for it.

Requests

• GET, POST, PUT, PATCH, DELETE, HEAD and OPTIONS, with a colored method pill.
• Query parameters and headers as a table, or as a JSON object: toggle at the top right, both views edit the same rows. Rows you switch off are kept but not sent.
• Header names autocomplete as you type, and so do values for Content-Type, Accept, Authorization and other common headers.
• Bodies: JSON, XML, plain text, form URL-encoded, and multipart with file upload (prefix a value with @ or use Add File…). Content-Type is set from the body type unless you set one yourself.
• A code editor for JSON, XML and text bodies: syntax highlighting, braces and quotes that close themselves, auto-indent, and one-click JSON formatting. Invalid JSON shows a quiet badge with the parser's exact message.
• Per-request timeout and redirect policy.

Auth

• Bearer token, HTTP Basic, API key (as a header or a query parameter), OAuth 2.0, or none.
• Every request can inherit its collection's default auth, so a whole API is configured in one place.
• Any field can be a {{variable}}, so secrets stay in environments and exported collections stay clean.

OAuth 2.0

Pick OAuth 2.0 in the Auth tab, fill in the endpoints (or pick a preset), and press Send. Retriever gets the token, attaches it, and keeps it fresh.

• Automatic refresh. A token about to expire is refreshed before the request goes out. If the server still answers 401, Retriever refreshes once and retries — without opening a browser.
• Any redirect URI. http://127.0.0.1/callback starts a one-shot listener on your Mac (any free port, bound to 127.0.0.1 only). A custom scheme like retriever://oauth/callback uses the macOS sign-in sheet with your default browser's logins. An https redirect — including one registered for Postman — opens an in-app browser that stops at the redirect.
• Presets for GitHub, Google, Microsoft Entra ID, Auth0, Okta and Spotify.
• Tokens follow your environment. Requests whose settings resolve the same share one token; switch from Staging to Production and you get Production's token.
• A token card shows whether the token is valid, when it expires and its scopes, with Get New Token, Refresh, Clear and copy.
• Advanced: client authentication as a Basic header or in the body, the token in a header (with any prefix) or a query parameter, the OpenID Connect id_token instead of the access token, and extra parameters for the authorization URL and token requests (audience, prompt, access_type…).
• Tokens are stored in oauth-tokens.json next to your workspace, readable only by you — never in workspace.json and never in exports.

Environments, variables and dynamic values

• {{name}} anywhere: URL, params, headers, body, auth. Values come from the active environment first, then the collection, and can reference other variables.
• Environments switch from the toolbar. An environment variable named baseUrl overrides the collection's base URL, which is how Local, Staging and Production switch servers.
• Undefined variables are highlighted before you send; resolved ones show their value on hover.
• Dynamic values, fresh on every send: {{$uuid}}, {{$timestamp}}, {{$timestampMs}}, {{$isoTimestamp}}, {{$date(yyyy-MM-dd)}}, {{$randomInt(1,100)}}, {{$randomString(12)}}, {{$base64(text)}}, {{$env(HOME)}}.

Response chaining, without scripts

• Read the last response of another request: {{@Login.body.data.token}}, {{@Login.header.Set-Cookie}}, {{@Login.status}}. Array items use .0, .1, …
• Right-click any value in a response (tree row or header) and choose Copy as Chain Reference.
• Chained requests get a link in the sidebar and a reads from / feeds strip with freshness dots.
• Send chain runs every dependency in order, then the request.

Responses

• Status, time, size and content type at a glance. Click the status for a plain-English guide: what it means, what to check, and a link to MDN.
• JSON as a collapsible tree: order-preserving, virtualized rows, key previews on folded objects, fold to level two, collapse or expand all. Large payloads fold automatically and are parsed off the main thread.
• Copy a value, its path, or a chain reference. A raw view with real text selection for megabyte bodies.
• Response headers, and the exact request that was sent, with every variable resolved.
• The last 25 responses of every request are kept, so switching back is instant.

Code generation

• ⇧⌘C turns a request into cURL, Swift (URLSession), JavaScript (fetch), Node.js (https), Python (requests), Go (net/http) or HTTPie — highlighted, with variables and the current OAuth token already filled in.
• Copy as cURL from the menu or the sidebar in one step.

Import and export

• cURL: paste a command, or ⇧⌘V to import straight from the clipboard.
• Postman Collection v2.1, including folders, auth and OAuth 2 settings, and Postman environments.
• OpenAPI 3 and Swagger 2 (JSON): operations become requests grouped by tag, servers become the base URL, and security schemes — bearer, basic, API key and OAuth 2 — become the collection's auth.
• Export any collection as Postman Collection v2.1.
• Coming from Paw? The migration guide maps every concept.

Organizing

• Collections with folders, drag to move, duplicate, rename in place.
• Each collection has a base URL (prefixed to relative URLs like /users, available as {{baseUrl}}), its own variables, default auth, notes, an icon and a color.
• Per-request notes for gotchas and example IDs.
• A sidebar filter, and a sidebar that folds to a slim rail.
• A starter collection against the free DummyJSON API — 40+ real requests, including a login → token → authenticated chain.

Undo and history

• ⌘Z / ⇧⌘Z undo and redo deletes, moves, renames, imports and edits, 100 steps deep. Text fields keep their own typing undo.
• Request history (⌥⌘Y, the toolbar clock, or right-click a request): every earlier revision of the request with a line-by-line diff against now — URL, params, headers, body, auth, docs, settings — and one-click restore. Tokens and passwords show only their last four characters.
• A revision is saved when you leave a request you edited, so each editing session is one step back.
• Version history (⌥⌘Z): saved copies of the whole workspace, taken before every delete, import and restore, before changes from the MCP server, and every 10 minutes while you edit. See what differs from now and restore a single request, folder, collection or environment, or the whole workspace.
• Versions are plain workspace.json copies in versions/: all of today's, one a day for a month, one a week for a year.

Keyboard

• ⌘K quick open: fuzzy-find any request, switch environments, run commands.
• ⌘↩ send, ⌘N new request, ⌘O import, ⇧⌘C generate code, ⌘S fold the sidebar.
• Every shortcut is rebindable in Settings: click it, press new keys.

MCP server for AI agents

Retriever ships a Model Context Protocol server, so Claude Code, Cursor or any MCP client can work with your requests. It uses the same workspace as the app: what an agent changes appears in your sidebar within a second, and the responses it fetches land in your history.

claude mcp add retriever -- /Applications/Retriever.app/Contents/MacOS/retriever-mcp

Seventeen tools: list_collections, list_requests, get_request, send_request, send_adhoc, create_request, update_request, delete_request, get_last_response, list_environments, set_active_environment, set_variable, update_collection, import_curl, generate_code, export_postman and oauth_token.

• Values that look like secrets are masked unless the agent asks to reveal them.
• Requests that use OAuth 2 get their token automatically. The agent reuses and refreshes tokens you got in the app; browser sign-ins happen once, in the app.
• It makes only the requests your agent asks for, and nothing else.

Your data

• Everything lives in ~/Library/Application Support/Retriever/: workspace.json for collections and environments, one history file per request, versions/ with earlier copies of the workspace, and oauth-tokens.json for tokens.
• Plain, readable JSON. Back it up, sync it, or commit it to git.
• No account, no telemetry. The only network traffic is the requests you send, plus a daily license check with Polar that sends only your key and this Mac's activation ID.
• Native Swift, signed and notarized by Apple, macOS 15 or later.

Not in yet

• A cookie jar
• Custom JavaScript dynamic values and extensions
• GraphQL introspection, WebSockets, Server-Sent Events, gRPC
• Tabs for several open requests

The roadmap is ordered by what people moving from Paw run into first. Tell me what blocks you.

Get it

A one-time purchase: $19 at the early adopter price, $39 later. No subscription, no account. The license key arrives by email; download the app and paste it in.

Buy Retriever for $19