API Tester
Build a request, send it, and inspect the response - with reference material alongside so you don't have to leave the page.
- •CORS is enforced by the browser, not this tool - requests to servers that don't allow your origin will fail here even if they'd work from a backend or Postman.
- •Secrets in the browser - tokens/keys typed here are visible in devtools and (if you persist history) in localStorage. Don't paste production secrets on a shared machine.
- •GET/HEAD have no body - some servers reject or silently drop a body sent with these methods.
- •Content-Type must match the body - sending JSON without
application/jsonis a common source of 400s. - •Idempotency - retrying a failed POST can create duplicates; GET/PUT/DELETE are generally safe to retry.
- •Rate limits - a 429 means slow down; check for a
Retry-Afterheader before hammering the endpoint again.
Response
Send a request to see the response here.
History
Sent requests will show up here.
How a request flows