Skip to content
JR ToolkitsRuns entirely in your browser. Nothing is uploaded.
中文

API tester — HTTPS requests from your browser

Fill in a URL, headers and credentials, send an HTTPS request straight from your browser and read the formatted JSON response. Nothing passes through our servers.

Four steps to your first request

  1. Pick an HTTP method and paste the full URL into the address field.
  2. If the API needs credentials, open Authentication and choose Bearer, Basic or API key.
  3. If you are sending data, open JSON Body and paste the JSON in.
  4. Press Send. The status, timing, size and formatted response appear on the right.

To see it working first, press load-sample. It fills in a GET against a public test API, so you can press Send straight away.

What goes in each field

  • Pick the method by what you are doing: GET to read, POST to create, PUT or PATCH to change, DELETE to remove.
  • The URL needs to be complete, including the https at the front. A URL that already carries query parameters can be pasted whole.
  • Query parameters go in one per row. Spaces, symbols and non-English characters are encoded for you.
  • Headers go in one per row. The tick box on the left switches a row off, which beats deleting and retyping when you are comparing results.
  • Fill in one authentication method and the tool turns it into the right header or query parameter.
  • The JSON body only applies to POST, PUT, PATCH and DELETE. Press format to tidy the indentation after pasting.
  • A malformed body is caught the moment you press Send, so you never wait for a confusing server error.

Reading the response

  • The top line gives the status code, how long it took and how big it was. A green 2xx means success; a red 4xx or 5xx means it failed.
  • The Body tab formats JSON for you. Press Pretty to switch back to exactly what the server sent.
  • A response that is not JSON is still shown in full, with one line of explanation.
  • The copy button in the corner copies whatever you are currently looking at.
  • The Headers tab lists the headers that came back with this response.

That tab usually shows fewer headers than the server actually sent. Browsers only hand a page the headers a server explicitly publishes. That is a browser safety rule, not a problem with your request.

Three things to check when nothing comes back

When the red message says the browser could not complete the request, it is usually one of these.

  1. The URL is not https. This page is served over https, and browsers refuse to call http URLs from here.
  2. The API does not accept calls from other websites, which is the CORS rule described below.
  3. The URL has a typo, the domain does not exist, or the network is down.

For safety reasons the browser never tells a page which of the three it was, so the message can only list them. Press F12, open the developer tools and read the Console tab to see the exact reason.

Which APIs you can call

The request goes out from your own browser, so whether it works depends on the API allowing calls from other websites. That mechanism is called CORS.

  • Public APIs for open data, weather or exchange rates usually work straight away.
  • Internal company APIs normally allow only their own front end and will be blocked.
  • An API you maintain yourself works as soon as you add the allow-origin setting on the server.
  • With a token or a custom header the browser first sends an OPTIONS request to ask, and a server that ignores it fails.
  • Local services are exempt, so http://localhost:3000/… can be tested directly.

If the API simply does not allow it, no browser-based tool will get through and you need a desktop API client instead.

Saving the requests you use often

  • Press the save icon, give it a name, and it comes back from the dropdown next time. Thirty saves are allowed.
  • The method, URL, query parameters, headers and body are all kept together.
  • Token, password and API key values are left out, so retype them after loading.
  • The auth type and field names stay, so there is nothing else to set up again.
  • Saves live in this browser on this machine, and disappear if you clear your browsing data.

Secrets are left out to keep production tokens off the machine. Browser storage has no expiry date and never clears itself.

Do your URLs and tokens pass through us

No. Your browser sends the request straight to the URL you typed. There is no backend here and nothing is relayed. Credentials live in this tab’s memory and are gone when you close it, and cross-origin requests never carry cookies, so a session you have open elsewhere is not sent along. Internal URLs and production tokens are safe to paste. See theprivacy policy for the details.