Skip to main content

Haiku for Desktop

Record any desktop app. Not just the browser. Download the Haiku desktop app, authorize your device, and start capturing.

https://gethaiku.ai/download

Download the app

Go to the desktop app download page. Select Download Apple Chip or Download Intel Chip for Mac, or Windows for Windows.

Open the downloaded file and follow the installation steps.

Grant permissions

Haiku needs screen recording permission to capture your desktop. When prompted, open System Settings and enable it for Haiku. You may need to restart the app after granting permission.

Authorize your device

On first launch, Haiku asks you to authorize the device. An Authorize Device prompt appears. Confirm your account and select Approve.

Start a capture

Once authorized, select Create haiku from the Haiku desktop app. Select the screen or application you want to record.

Your capture starts immediately. Every click is recorded as a step.

Localization

Haiku for desktop is available in 6 languages: English, German, Spanish, French, Japanese, and Portuguese (Brazil).

Network & Whitelisting Specifications for Haiku Desktop

Product: Haiku Desktop
​Publisher: WalkMe Ltd.
​Bundle / App ID: ai.gethaiku.desktop
​Homepage: https://gethaiku.ai

Use this document with enterprise firewall, proxy (Zscaler / Netskope / Palo Alto), and EDR teams so endpoints can reach Haiku services and run the local loopback helper.

1. Outbound Traffic (Egress / API Access)

All required traffic is outbound HTTPS (TCP 443) from machines running Haiku Desktop. No inbound internet ports are required.

1.1 Required production domains

Purpose

Target domain

Protocol

Port

REST APIs (auth profile, teams, capture upload, analytics)

api.gethaiku.ai

HTTPS (TCP)

443

Web app / sign-in UI loaded by the desktop

app.gethaiku.ai

HTTPS (TCP)

443

Auto-update feed & installer downloads

cdn.gethaiku.ai

HTTPS (TCP)

443

Cognito JWT verification (JWKS)

cognito-idp.eu-central-1.amazonaws.com

HTTPS (TCP)

443

Recommended wildcard (covers API, app, CDN, and future subdomains):

  • Allow: *.gethaiku.ai on TCP 443

Path examples under api.gethaiku.ai (same host; no extra firewall rules needed):

  • /users-mgmt/*

  • /snap-backend/*

  • /snap-analytics/*

Action required: Allow outbound HTTPS from endpoints running Haiku Desktop to the domains above (or *.gethaiku.ai plus Cognito).

1.2 Required for sign-in (OAuth)

Provider

Domains to allow (HTTPS / 443)

Google

*.google.com, *.googleapis.com, *.gstatic.com, *.googleusercontent.com

Microsoft

*.microsoftonline.com, *.live.com, *.msftauth.net, *.msauth.net

1.3 SSL/TLS decryption (DPI) note

If the network uses SSL/TLS inspection (Zscaler, Palo Alto, Netskope, etc.), add at least these hosts to the **SSL Inspection Bypass** list:

  • api.gethaiku.ai

  • app.gethaiku.ai

  • cdn.gethaiku.ai

  • cognito-idp.eu-central-1.amazonaws.com

  • Prefer: *.gethaiku.ai

Bypass avoids TLS handshake failures with corporate MITM certificates. Prefer FQDN/SNI allow rules over IP lists.

1.4 Static IPs

Do not rely on static IP allowlists.
​
​api.gethaiku.ai, app.gethaiku.ai, and cdn.gethaiku.ai sit behind CDN / load-balanced frontends with dynamic IPs. Cognito is AWS-managed and is not a fixed IP set.
​
​IT must use domain-based (FQDN / SNI) rules, not hardcoded IPs.
​

2. Local Port & Host Binding (Port 18922)

Field

Value

Port

18922

Protocol

TCP

Binding

127.0.0.1 only (localhost)

Direction

Loopback / host-local only

Purpose: Local HTTP between the user's browser (or https://app.gethaiku.ai) and Haiku Desktop for:

  • Desktop presence (GET /health)

  • Capture handoff (GET /capture-data)

  • Browser > desktop auth handoff (POST /desktop-auth)

Important for IT:

  • Traffic never leaves the machine.

  • No inbound LAN or internet firewall rule is required.

  • Do **not** open port 18922 on the corporate perimeter or to other LAN hosts.

  • If host firewalls block loopback unusually, allow Haiku Desktop to bind/listen on 127.0.0.1:18922 (application exception), not a network inbound rule.

3. Endpoint Security & Executable Whitelisting (EDR / Antivirus)

Field

Value

Product name

Haiku Desktop

Windows process / exe

haiku-desktop.exe (installer product name: Haiku Desktop)

macOS app

Haiku Desktop.app

macOS bundle ID

ai.gethaiku.desktop

Windows publisher (Authenticode CN)

Walkme Ltd.

macOS signing

Apple Developer ID Application (WalkMe / Haiku team)

Action required: Allowlist by publisher certificate and/or install path in EDR/AV (CrowdStrike, Defender for Endpoint, SentinelOne, etc.) so the app can:

  • Run in the background

  • Bind the local health server on 127.0.0.1:18922

  • Download and apply updates from cdn.gethaiku.ai

  • Use screen / input capture helpers (OS permission prompts still apply on macOS)

Typical install locations (may vary by deployment):

  • Windows: under Program Files or user AppData for the NSIS install of Haiku Desktop

  • macOS: /Applications/Haiku Desktop.app

4. Summary checklist for IT

  1. Allow outbound TCP 443 to *.gethaiku.ai (minimum: api, app, cdn) plus Cognito (cognito-idp.eu-central-1.amazonaws.com).

  2. Allow OAuth domains for Google and/or Microsoft if users sign in with those providers.

  3. Bypass SSL inspection for those Haiku (and Cognito) hosts if DPI is enabled.

  4. Use FQDN/SNI rules - IPs are not stable

  5. Do not open inbound ports. Port 18922 is localhost-only.

  6. Allowlist Haiku Desktop / publisher Walkme Ltd. in EDR/AV.

Clarifications

Question

Answer

Is the local port LAN-wide?

No. Bound to 127.0.0.1:18922 only. No inbound LAN/internet access.

Static IPs for API/CDN?

No. Domain-based allowlisting required.

Related Articles
Did this answer your question?