Local API

Authenticate to the local API.

Every request to a /v1 route must carry the API token as a bearer token. The desktop app makes the token and keeps it on your computer.

Authorization: Bearer <token>

Where to find the token

Open Integrations (Cmd/Ctrl+I) → Local API. The tab has the Enable Local API Server switch, the Port, the Authentication Token with a copy button, and an example request. More examples opens ready requests in cURL, JavaScript and Python with your token filled in; keep copies of them private.

Export it

# ~/.zshrc or ~/.bashrc
export DONUT_API_KEY="<token>"

# Add to $PROFILE to keep it
$env:DONUT_API_KEY = "<token>"

Send it

curl -sS http://127.0.0.1:10108/v1/profiles \
  -H "Authorization: Bearer $DONUT_API_KEY"

const response = await fetch("http://127.0.0.1:10108/v1/profiles", {
  headers: { Authorization: `Bearer ${process.env.DONUT_API_KEY}` },
});

import os, requests

response = requests.get(
    "http://127.0.0.1:10108/v1/profiles",
    headers={"Authorization": f"Bearer {os.environ['DONUT_API_KEY']}"},
    timeout=10,
)

Invoke-RestMethod -Uri "http://127.0.0.1:10108/v1/profiles" `
    -Headers @{ Authorization = "Bearer $env:DONUT_API_KEY" }

/openapi.json and /v1/openapi.json need no token.

What the token grants

One token opens every /v1 route. Anyone with it can create and delete profiles, read cookies and, on Pro, launch and drive browsers. The server listens on 127.0.0.1 only, so a caller must already run on your computer. On a shared computer, keep the token out of shell history and shared scripts.

This token opens the local API only. Remote MCP uses a dmk_ credential instead; see Remote MCP.

Errors

Check the status code: the 401 body is empty.

Checked against the app on October 14, 2026.