Scratch paper for APIs.
Fire a request, read the answer, move on. ScratchAPI is a quick desktop app for HTTP, with sign-in that looks after itself and collections that are just files on your disk.
- accounts
- cloud sync
- telemetry
Environment
Local
Requests
Books API
{
"id": 1,
"email": "admin@example.com",
"verified": true
}
- WriteMethod, URL, params, headers and body.
{{variables}}light up as you type. - SendIf a token is missing or expired, the collection signs in first and retries for you.
- CapturePull a value out of the response into your environment with one rule.
- ReuseKeep it in a collection, copy it as cURL, or export it as JSON.
Small app. Not a small feature list.
The highlights are below. The features page covers everything, section by section.
Bearer, Basic, API key and OAuth 2.0, set once per collection
Pick a type on the collection and every request inherits it. OAuth 2.0 supports client credentials, password and authorization code with PKCE. Tokens renew before they expire, or after a 401.
Log in once, reuse everywhere
Save accessToken from a response into ACCESS_TOKEN. Done.
Environments that tell you when you're wrong
Blue when defined, amber when missing, red when circular. Mark secrets as sensitive to keep them masked.
Folders you can actually open
Click a folder for its overview: counts, subfolders and every request inside, filterable by method.
Find the needle
Colour-coded JSON, separate Data and Headers tabs, copy button, and Ctrl+F search with highlighted matches.
In and out
Copy any request as cURL, with values filled in or placeholders kept. Paste a cURL command into the URL field to turn it into a request.
Notes live with the request
Markdown descriptions on collections and requests, plus an argument list with required or optional flags and defaults.
All features →Sign-in is not your job.
Authentication belongs to the collection, not to a chain of requests you have to remember to run first.
- 1Choose how the API signs you inBearer token, Basic, API key in a header or query parameter, OAuth 2.0, or your own login and refresh requests.
- 2Send anythingEach request in the collection carries the credentials. No token yet? The login runs first.
- 3Expired? Handled.On a 401 the token is renewed and your request is retried once. A note in the response says what happened.
// Collection → Authentication Type OAuth 2.0 Grant Authorization code (PKCE) Redirect http://127.0.0.1 (loopback) Token stored in active environment // or: login-request flow Token variable ACCESS_TOKEN Header Authorization: Bearer {{ACCESS_TOKEN}} Login request Authentication / Login Refresh request Authentication / Refresh Token
Responses feed the next request.
After a successful (2xx) response, a rule copies a value from a JSON path like data.access_token or items[0].id, or from a response header, into a variable of the active environment. The response panel confirms what was saved and warns when a rule could not apply.
Just files. Your files.
Collections, environments and history are readable JSON in the app's data folder (~/.config/scratchapi/ on Linux), written owner-only. Back them up, diff them, or export a collection to share it. Environments are never exported, so secrets stay put.
{
"name": "Books API",
"description": "All requests must be authenticated.",
"auth": {
"type": "bearer",
"token": "{{ACCESS_TOKEN}}"
},
"folders": [
{ "name": "Reading", "requests": [
{ "title": "Book Search",
"method": "GET",
"url": "{{base_url}}/books/search" }
] }
]
}
Pick your platform.
A desktop app built for your favourite system.
# Debian / Ubuntu
sudo apt install ./scratchapi_*_amd64.deb