Haiku for Desktop
Record any desktop app. Not just the browser. Download the Haiku desktop app, authorize your device, and start capturing.
Download the app
Go to the desktop app download page. Select Download Apple Chip or Download Intel Chip for Mac, or Windows for Windows.
Open the downloaded file and follow the installation steps.
Grant permissions
Haiku needs screen recording permission to capture your desktop. When prompted, open System Settings and enable it for Haiku. You may need to restart the app after granting permission.
Authorize your device
On first launch, Haiku asks you to authorize the device. An Authorize Device prompt appears. Confirm your account and select Approve.
Start a capture
Once authorized, select Create haiku from the Haiku desktop app. Select the screen or application you want to record.
Your capture starts immediately. Every click is recorded as a step.
Localization
Haiku for desktop is available in 6 languages: English, German, Spanish, French, Japanese, and Portuguese (Brazil).
Network & Whitelisting Specifications for Haiku Desktop
Product:
Haiku Desktop
Publisher: WalkMe Ltd.
Bundle / App ID: ai.gethaiku.desktop
Homepage:
Use this document with enterprise firewall, proxy (Zscaler / Netskope / Palo Alto), and EDR teams so endpoints can reach Haiku services and run the local loopback helper.
1. Outbound Traffic (Egress / API Access)
All required traffic is outbound HTTPS (TCP 443) from machines running Haiku Desktop. No inbound internet ports are required.
1.1 Required production domains
| Purpose | Target domain | Protocol | Port |
|---|---|---|---|
| REST APIs (auth profile, teams, capture upload, analytics) | api.gethaiku.ai | HTTPS (TCP) | 443 |
| Web app / sign-in UI loaded by the desktop | app.gethaiku.ai | HTTPS (TCP) | 443 |
| Auto-update feed & installer downloads | cdn.gethaiku.ai | HTTPS (TCP) | 443 |
| Cognito JWT verification (JWKS) | cognito-idp.eu-central-1.amazonaws.com | HTTPS (TCP) | 443 |
Recommended wildcard (covers API, app, CDN, and future subdomains):
- Allow:
*.gethaiku.aion TCP 443
Path examples under api.gethaiku.ai (same host; no extra firewall rules needed):
/users-mgmt/*/snap-backend/*/snap-analytics/*
Action required:
Allow outbound HTTPS from endpoints running Haiku Desktop to the domains above (or *.gethaiku.ai plus Cognito).
1.2 Required for sign-in (OAuth)
| Provider | Domains to allow (HTTPS / 443) |
|---|---|
*.google.com, *.googleapis.com, *.gstatic.com, *.googleusercontent.com | |
| Microsoft | *.microsoftonline.com, *.live.com, *.msftauth.net, *.msauth.net |
1.3 SSL/TLS decryption (DPI) note
If the network uses SSL/TLS inspection (Zscaler, Palo Alto, Netskope, etc.), add at least these hosts to the **SSL Inspection Bypass** list:
api.gethaiku.aiapp.gethaiku.aicdn.gethaiku.aicognito-idp.eu-central-1.amazonaws.com- Prefer:
*.gethaiku.ai
Bypass avoids TLS handshake failures with corporate MITM certificates. Prefer FQDN/SNI allow rules over IP lists.
1.4 Static IPs
Do not rely on static IP allowlists.
api.gethaiku.ai, app.gethaiku.ai, and cdn.gethaiku.ai sit behind CDN / load-balanced frontends with dynamic IPs. Cognito is AWS-managed and is not a fixed IP set.
IT must use domain-based (FQDN / SNI) rules, not hardcoded IPs.
2. Local Port & Host Binding (Port 18922)
| Field | Value |
|---|---|
| Port | 18922 |
| Protocol | TCP |
| Binding | 127.0.0.1 only (localhost) |
| Direction | Loopback / host-local only |
Purpose
: Local HTTP between the user's browser (or https://app.gethaiku.ai) and Haiku Desktop for:
- Desktop presence (
GET /health) - Capture handoff (
GET /capture-data) - Browser > desktop auth handoff (
POST /desktop-auth)
Important for IT:
- Traffic never leaves the machine.
- No inbound LAN or internet firewall rule is required.
- Do **not** open port 18922 on the corporate perimeter or to other LAN hosts.
- If host firewalls block loopback unusually, allow Haiku Desktop to bind/listen on
127.0.0.1:18922(application exception), not a network inbound rule.
Endpoint Security & Executable Whitelisting (EDR / Antivirus)
| Field | Value |
|---|---|
| Product name | Haiku Desktop |
| Windows process / exe | haiku-desktop.exe (installer product name: Haiku Desktop) |
| macOS app | Haiku Desktop.app |
| macOS bundle ID | ai.gethaiku.desktop |
| Windows publisher (Authenticode CN) | Walkme Ltd. |
| macOS signing | Apple Developer ID Application (WalkMe / Haiku team) |
Action required : Allowlist by publisher certificate and/or install path in EDR/AV (CrowdStrike, Defender for Endpoint, SentinelOne, etc.) so the app can:
- Run in the background
- Bind the local health server on
127.0.0.1:18922 - Download and apply updates from
cdn.gethaiku.ai - Use screen / input capture helpers (OS permission prompts still apply on macOS)
Typical install locations (may vary by deployment):
Windows : under Program Files or user AppData for the NSIS install of Haiku Desktop
macOS
: /Applications/Haiku Desktop.app
Summary checklist for IT
- Allow outbound TCP 443 to
*.gethaiku.ai(minimum:api,app,cdn) plus Cognito (cognito-idp.eu-central-1.amazonaws.com). - Allow OAuth domains for Google and/or Microsoft if users sign in with those providers.
- Bypass SSL inspection for those Haiku (and Cognito) hosts if DPI is enabled.
- Use FQDN/SNI rules - IPs are not stable
- Do not open inbound ports. Port 18922 is localhost-only.
- Allowlist Haiku Desktop / publisher Walkme Ltd. in EDR/AV.
Clarifications
| Question | Answer |
|---|---|
| Is the local port LAN-wide? | No. Bound to 127.0.0.1:18922 only. No inbound LAN/internet access. |
| Static IPs for API/CDN? | No. Domain-based allowlisting required. |
Related articles
The Haiku extension is what makes capturing possible. Install it once. It works across every website and web app you use.
Only admins can invite new members. You can invite people at any point — during setup or after.
A team is a shared workspace. Everyone on the team can see the haikus in it, leave comments, and collaborate on guides.