ToolVault

Symptom: the request won't go through or returns nothing

You fill the URL and params in an API tester, hit send, and either the browser console turns red (CORS) or you get 401/403/405. Troubleshoot in order of easiest first.

1. Sending a Token: how to set the Authorization header

Most authenticated endpoints rely on a token in the request header. In the API Tester on ToolVault:

1. Switch to the "Headers" area;
2. Add Key = Authorization, Value = Bearer <your-token> (note the space after Bearer);
3. For API-key mode, it's usually Key = X-API-Key, Value = <key>.

Note: many 401s are not a wrong token but a missing Bearer prefix or a stray newline. Send the header verbatim via the tool, then compare with what the backend expects.

2. CORS errors: whose problem is it

CORS (Cross-Origin Resource Sharing) is a browser security policy, unrelated to the data the server returns. It looks like:

Access to fetch at 'https://api.xxx.com' from origin 'https://wcytcn.com'
has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header

| Symptom | Meaning | What you can do | |---|---|---| | Browser CORS error, but Postman works | Server didn't whitelist your origin | Ask backend for Access-Control-Allow-Origin, or use a same-origin proxy | | Preflight (OPTIONS) returns 405/403 | Server doesn't handle OPTIONS | Backend must allow OPTIONS | | Custom header still blocked | Needs Access-Control-Allow-Headers | Backend must declare the header |

Key point: a front-end tool cannot "bypass" CORS — it's a protocol-level restriction. The real fix is always backend config or a same-origin proxy.

3. Other frequent errors

| Error | Common cause | Check | |---|---|---| | 405 Method Not Allowed | Endpoint doesn't support your GET/POST | Verify method in docs; switch in tool | | Hangs / no response | Wrong host, port closed, HTTP/HTTPS mix | Verify connectivity with curl first | | 400 Bad Request | Bad body format (e.g. missing quote in JSON) | Validate body with JSON Formatter | | Returns HTML not JSON | Hit a gateway/login page | Read the response body — usually not the real API |

How to locate step by step

Open the API Tester:

1. Enter the URL, try GET to confirm connectivity;
2. Add Headers (auth) and Body (JSON), switch method;
3. Read "status code" and "response headers", compare with the table above;
4. To reproduce in code, use curl-to-code to generate it.

Check status meanings anytime via HTTP Status Codes.

FAQ

Why does Postman work but the browser throws CORS?

Postman doesn't enforce the browser's same-origin policy — it just sends. The browser does the CORS check for you, so the difference is the browser, not the API.

Can the tool bypass CORS for me?

No, and it shouldn't. CORS protects users. The correct fix is backend whitelisting or proxying through your own server.

401 vs 403 — what's the difference?

401 = no/invalid credential (unauthenticated); 403 = valid credential but no permission (authenticated, denied). Fix 401 (token correct) before worrying about 403.

Provided by ToolVault. Related tools: HTTP Status Codes, curl-to-code, HTTP Method Cheatsheet. Visit the home page for more developer tools.