English · Deutsch
RDAPI is a small, self-hosted API server for the RustDesk app. It adds what a household or a small team needs on top of your own ID and relay server: signing in to the app, a personal address book that follows you to every device, a list of your devices and a history of incoming connections, plus a web interface to manage it all.
Important
Public beta. Everything in RDAPI works, but the official RustDesk ID server (hbbs, up to 1.1.16) cannot yet connect a signed-in app: connections fail with “Failed to secure tcp: deadline has elapsed”. This happens with any API server and is fixed in RustDesk's pull request #706. Until an ID server release contains the fix, sign-in, address book, devices and history work, but to connect, sign out in the app first. Version 1.0 follows once the fix is released.
- Sign-in in the app with username and password, several users, admins and regular users
- Address book per user with tags, synchronised between all devices you sign in on and editable in the web interface as well
- Shared address books for the family or the team, per user or group with read only, read and change or full control
- Device list with online status, operating system and version; the app shows your devices and those of your groups under “Accessible devices”
- Connection history: who connected to which device, when and for how long, plus the files copied during a connection
- Web interface for devices, history, address book, users, sign-ins and your account, in six languages (English, German, French, Spanish, Italian, Dutch), light and dark theme
- Two-factor sign-in with an authenticator app, in the web interface and in the RustDesk app, with recovery codes
- Passkeys and security keys (FIDO2) in the web interface: sign in without a password or use them as second factor
- Single sign-on through an OpenID Connect provider such as Authelia, in the web interface and in the app; the normal sign-in stays
- Security: Argon2id passwords, tokens stored only as hashes, failed sign-ins limited per address and per user, devices bound to their own key, sign-in log, container runs read-only without root
- Daily automatic backups, download and restore in the web interface
- Small and easy to run: one container, one SQLite file, images for amd64 and arm64
| Connection history | Address book |
|---|---|
 |
 |
You need Docker with Docker Compose 2.24 or newer and your own RustDesk ID and relay server.
mkdir rdapi && cd rdapi
curl -O https://raw.githubusercontent.com/schnuecks/rdapi/main/compose.yaml
mkdir data && chown 1000:1000 data
docker compose up -dOpen http://<server>:21114 and create the admin account; the setup code is in the log
(docker compose logs rdapi). Then enter the address as API server in the app
under Settings → Network. To update: docker compose pull && docker compose up -d.
For use over the internet, put the server behind a reverse proxy with HTTPS; see Installation.
- Installation: quick start, reverse proxy, updating, data and backups, moving from another API server
- Configuration: all settings, single sign-on, user accounts, command line
- Usage: setting up the app, web interface, two-factor sign-in, passkeys, backups, troubleshooting
- Development: running locally, tests, API endpoints, translations, releases
What changed in each version is listed in the CHANGELOG.
RDAPI holds the keys to your remote desktop, so security gets extra attention:
- Built in: Argon2id passwords, tokens stored only as hashes, two-factor sign-in, passkeys, per-address and per-user limits on failed sign-ins, CSRF tokens and an origin check on forms, a strict Content Security Policy, and a read-only container without root.
- Checked on every change: test suite, Trivy scan of the image, OWASP ZAP baseline scan, Dependabot. GitHub Actions are pinned to commit hashes.
- Reviewed: before the public beta, an AI-assisted security review went through sign-in, device ownership, single sign-on and the app API. Every finding was reproduced with a test, fixed and re-tested – see versions 0.10.x in the changelog.
Please report vulnerabilities privately, see SECURITY.md.
RDAPI is developed with the help of an AI coding assistant. I define the features and behaviour, review the changes and test them on my own server with the RustDesk app. Nothing is released without passing the automated checks: the test suite and a security scan of the container image.
RDAPI is free and stays free. If it saves you time, you can buy me a coffee; it keeps the project going. Thank you!
Bug reports and ideas are welcome as GitHub issues. Please report security problems privately; see SECURITY and CONTRIBUTING.
Copyright (C) 2026 Schnuecks
RDAPI is free software under the GNU Affero General Public License, version 3 or later (AGPL-3.0-or-later). You may use, modify and share it.
If you distribute a modified version or offer it to others over a network, you must make
the source code of your version available to them under the same license. The “Source
code on GitHub” link in the footer does that for this version; for your own version,
point it to your source code (APP_REPO in rdapi/web.py).
The program is provided without any warranty. See the license for details.
The Barlow fonts in rdapi/static/fonts/ are under the SIL Open Font License (see
OFL.txt there); RDAPI serves them itself, so no page loads anything from Google
or other servers. RustDesk is a trademark of its respective owners; this project is not
affiliated with it.