API tester — HTTPS requests from your browser

When a browser-based tester is the right tool

• You have the API docs and want to confirm the endpoint really returns the fields they describe.
• The front end keeps getting a 401 and you want one isolated attempt to tell an expired token from a mistyped header name.
• You are on someone else’s machine and installing a desktop client for one test is not worth it.
• You call the same endpoint every day and want the query parameters and headers saved once and recalled later.
• You need to show a colleague a response and want it formatted well enough to read the structure.

Four steps to your first request

1. Pick an HTTP method and paste the full URL into the address field.
2. If the API needs credentials, open Authentication and choose Bearer, Basic or API key.
3. If you are sending data, open JSON Body and paste the JSON in.
4. Press Send. The status, timing, size and formatted response appear on the right.

To see it working first, press load-sample. It fills in a GET against a public test API, so you can press Send straight away.

What goes in each field

• Pick the method by what you are doing: GET to read, POST to create, PUT or PATCH to change, DELETE to remove.
• The URL needs to be complete, including the https at the front. A URL that already carries query parameters can be pasted whole.
• Query parameters go in one per row. Spaces, symbols and non-English characters are encoded for you.
• Headers go in one per row. The tick box on the left switches a row off, which beats deleting and retyping when you are comparing results.
• Fill in one authentication method and the tool turns it into the right header or query parameter.
• The JSON body only applies to POST, PUT, PATCH and DELETE. Press format to tidy the indentation after pasting.
• A malformed body is caught the moment you press Send, so you never wait for a confusing server error.

Reading the response

• The top line gives the status code, how long it took and how big it was. A green 2xx means success; a red 4xx or 5xx means it failed.
• The Body tab formats JSON for you. Press Pretty to switch back to exactly what the server sent.
• A response that is not JSON is still shown in full, with one line of explanation.
• The copy button in the corner copies whatever you are currently looking at.
• The Headers tab lists the headers that came back with this response.

That tab usually shows fewer headers than the server actually sent. Browsers only hand a page the headers a server explicitly publishes. That is a browser safety rule, not a problem with your request.

Three things to check when nothing comes back

When the red message says the browser could not complete the request, it is usually one of these.

1. The URL is not https. This page is served over https, and browsers refuse to call http URLs from here.
2. The API does not accept calls from other websites, which is the CORS rule described below.
3. The URL has a typo, the domain does not exist, or the network is down.

For safety reasons the browser never tells a page which of the three it was, so the message can only list them. Press F12, open the developer tools and read the Console tab to see the exact reason.

Which APIs you can call

The request goes out from your own browser, so whether it works depends on the API allowing calls from other websites. That mechanism is called CORS.

• Public APIs for open data, weather or exchange rates usually work straight away.
• Internal company APIs normally allow only their own front end and will be blocked.
• An API you maintain yourself works as soon as you add the allow-origin setting on the server.
• With a token or a custom header the browser first sends an OPTIONS request to ask, and a server that ignores it fails.
• Local services are exempt, so http://localhost:3000/… can be tested directly.

If the API simply does not allow it, no browser-based tool will get through and you need a desktop API client instead.

Saving the requests you use often

• Press the save icon, give it a name, and it comes back from the dropdown next time. Thirty saves are allowed.
• The method, URL, query parameters, headers and body are all kept together.
• Token, password and API key values are left out, so retype them after loading.
• The auth type and field names stay, so there is nothing else to set up again.
• Saves live in this browser on this machine, and disappear if you clear your browsing data.

Secrets are left out to keep production tokens off the machine. Browser storage has no expiry date and never clears itself.

Do your URLs and tokens pass through us

No. Your browser sends the request straight to the URL you typed. There is no backend here and nothing is relayed. Credentials live in this tab’s memory and are gone when you close it, and cross-origin requests never carry cookies, so a session you have open elsewhere is not sent along. Internal URLs and production tokens are safe to paste. See theprivacy policy for the details.

Frequently asked questions

Why do some APIs never work no matter what I fill in?

Because the request goes out from your own browser, the API has to allow calls from other websites, which is CORS. If it does not, no browser-based tool will get through and you need a desktop API client. This site will not add a relay server for it, since that would route your URLs and tokens through our machines.

Can I upload a file or send form-data?

No. The request body is JSON only, and only POST, PUT, PATCH and DELETE can carry one at all. Use a desktop client for endpoints that take file uploads.

How long before a request gives up?

Thirty seconds. Past that people assume the tool is broken rather than the API being slow, so the request is aborted and a message is shown.

Why did one of my headers not take effect?

A set of headers cannot be set by a web page under the browser specification, among them Host, Origin, Cookie, Referer and anything starting with sec-. Browsers drop them silently, so the tool warns you instead of leaving you to debug a setting that never applied.

Do saved requests include my token?

No. Token, password and API key values are left out of a save; only the auth type and field names are kept, so you retype the secret after loading. Up to 30 saves are held in this browser on this machine.