# Baton

> A git-native API client for macOS, Windows, Linux, iOS, Android, and the browser — an alternative to Postman in which collections, environments, and schedules are plain YAML files in a git repository the user owns. There is no vendor cloud: nothing about a user's requests reaches the developer.

Key facts:

- The workspace is an ordinary git repository. Requests, environments, and schedules are YAML files in it, reviewable in a pull request and revertable with git.
- Protocols: REST/HTTP, GraphQL (POST transport with schema introspection), and WebSocket.
- Secrets never enter the workspace. Environment files store secret *names*; values live in OS secure storage (Keychain, DPAPI, libsecret, Keystore) and are resolved in memory at send time.
- Pre-request and test scripts are JavaScript with one `baton.*` API, sandboxed with a timeout, no filesystem, and no network beyond `baton.sendRequest`.
- Merge conflicts open a structured, field-by-field view — never raw `<<<<<<<` markers in an editor.
- Sync transports: the system `git` binary on desktop, and a host REST API (GitHub, GitLab, Bitbucket) on mobile and in the browser. Both write commits to the user's own repository.
- Baton Worker is optional and self-hosted (`ghcr.io/dudko-dev/baton-worker:latest`): it runs collections on a schedule, proxies requests for the browser build, and gives that build a real git checkout. It is not a service the developer operates.
- A local MCP server (`@dudko.dev/baton-mcp`, stdio) lets AI agents list, edit, and run requests in a workspace checkout.
- Registration is free and by email. A license key is valid for 180 days and is verified offline against a public key embedded in the app — the app never calls home to check it. Renewal is free: register again with the same address.
- Licensing: the application is proprietary and free for personal, non-commercial use. The three npm packages are licensed separately and may be used commercially at no charge by small entities — under USD 250,000 ever raised, a valuation under USD 250,000, and under USD 1,000,000 annual gross revenue, all three at once. Commercial licensing beyond that: siarhei@dudko.dev.
- Privacy: the app sends no telemetry and no crash reports. The website counts page views with Cloudflare Web Analytics (cookieless, public pages only). The site stores an email address for registrants and nothing else.

## Docs

- [Homepage](https://baton.dudko.dev/): what it is, what you get, downloads, and the worker.
- [Get a key](https://baton.dudko.dev/#get-a-key): free registration, and renewal for an expired key.
- [What you get](https://baton.dudko.dev/#what-you-get): protocols, platforms, secrets, scripts, conflicts.
- [Downloads](https://baton.dudko.dev/#downloads): builds for macOS, Windows, and Linux, each with its SHA-256.
- [Baton Worker](https://baton.dudko.dev/#worker): the optional self-hosted service, and how to run it.
- [User manual](https://baton.dudko.dev/manual/): every screen of the app, step by step, with annotated screenshots, in two guides — [desktop](https://baton.dudko.dev/manual/desktop/) for macOS, Windows, Linux and the web app ([PDF](https://baton.dudko.dev/manual/baton-desktop-manual.pdf)), and [iPhone and Android](https://baton.dudko.dev/manual/mobile/) ([PDF](https://baton.dudko.dev/manual/baton-mobile-manual.pdf)).
- [Full text](https://baton.dudko.dev/llms-full.txt): everything above at length, in one file.

## Optional

- [Web app](https://baton.dudko.dev/app): the browser build, with a demo workspace and nothing to install.
- [Release metadata](https://baton.dudko.dev/api/version): JSON with the current version, artifacts, sizes, and digests — the same manifest the app polls for updates.
- [Author](https://dudko.dev): Siarhei Dudko.