Online API tester: GET/POST/PUT/DELETE/PATCH with custom Headers/Body, 30s timeout with cancel. Postman alternative.
TL;DR: Free online HTTP API tester supporting GET, POST, PUT, DELETE, and PATCH. Custom Headers and Body, 30s timeout with cancel. A simplified Postman alternative, runs locally.
Editing and processing happen entirely in your browser. When sending requests, they are forwarded through this site's server-side proxy by default (to bypass browser CORS/mixed-content limits) — the target URL and headers pass through our server but are never logged; disable the proxy in settings for direct connections.
Next steps
Usage Guide
Send real HTTP requests and inspect full responses without writing code or installing Postman. By default requests travel through this site's server-side proxy, so you can test third-party endpoints that don't enable CORS — something browser-only tools cannot do.
1. Send your first request
The "Server Proxy" toggle is on by default: requests relay through this site's server, bypassing browser same-origin policy. To reproduce direct browser behavior (debugging CORS), turn it off — then the target API must allow cross-origin itself.
- Pick the method (GET/POST/PUT/DELETE/PATCH) and enter the full URL.
- For auth, add key-value pairs in Headers (e.g. Authorization: Bearer xxx) or use the Auth tab's Basic/Bearer templates.
- For POST-like verbs, switch to the Body tab and write JSON, form data or raw text.
- Hit "Send" — the response pane shows status, duration, the formatted body and response headers.
2. Productivity features
- Environments: store baseUrl/tokens per environment (dev/staging/prod) and reference {{variables}} in URLs — switching environments never edits requests.
- History saves recent requests automatically; click to refill. Save favorites as collections.
- "Import cURL" reverses a command-line curl statement into an editable request; "Copy as cURL" exports for the terminal.
- Timeout defaults to 30s (adjustable); timeouts and manual cancels get distinct messages. Raw+JSON bodies are syntax-checked before send.
3. Reading responses
The first digit of the status is the first clue: 2xx success, 3xx redirect (watch for login-page hijacks), 4xx request problems (401 auth, 403 permission, 404 path), 5xx server errors. If the body is HTML instead of JSON, your request never reached the API — usually a frontend-route fallback or a gateway error page; the tool banners Content-Type vs body mismatches and extracts the HTML title when present. JSON responses also list top-level keys for a quick structural skim. Through the proxy, also confirm the target firewall allows this site's egress IP.
4. A three-layer method for CORS errors
Browser CORS messages are misleading by design — they say "blocked by the browser" and never show what the server actually returned. Three layers: first, separate simple requests from preflighted ones — non-simple requests (custom headers, JSON bodies) send OPTIONS first, and the failure usually happens right there; second, replay the same request with this tool (bypassing the same-origin policy) to inspect the raw response headers — whether Access-Control-Allow-Origin came back at all, whether it echoes the origin or *, whether your custom header is missing from Access-Control-Allow-Headers; third, confirm the "works in curl, fails in browser" case — if so, the problem is 100% in response headers, not the request. The server-proxy mode of this tool exists precisely for layer two: it shows you the server bare response.
5. Four frequent causes of auth failures
- Token prefix: Authorization: Bearer <token> — a missing Bearer, an extra space, or wrong casing is the classic trio.
- Header-name casing: HTTP/1 is case-insensitive but gateways and frameworks may not be; X-Auth-Token vs x-auth-token can diverge at some layer.
- Expired token with an unhelpful 401: decode the JWT exp first (see the JWT tool on this site), then decide refresh vs re-login.
- Cookie-mode conflict: with credentials: include, the server cannot answer ACAO with * — it must echo the specific origin.
6. Proxy, timeout, and local checks
Server proxy (default) reaches APIs without CORS; turn it off to reproduce browser CORS. Timeouts vs cancel get distinct messages; Raw+JSON bodies are syntax-checked. History, collections, {{env}} vars, and cURL import/export speed regressions. Clear secrets from history after demos.
FAQ
Free, no sign-up, no caps — fire real HTTP requests at an API and inspect the full response without installing Postman.
Yes by default: requests are relayed by this site's server-side proxy to the target API, which bypasses browser CORS and mixed-content restrictions — that's what lets you test third-party endpoints that never enabled cross-origin, and in this mode the request content does reach the relay. Turn off "Server-side proxy" in Settings to reproduce genuine browser-direct behavior; the target must then allow CORS itself. Clear the history and screen after testing requests that carry secrets.
Yes — that is exactly what proxy mode is for. A console CORS message only says "blocked by the browser" and never what the server actually returned. Send the same request here to bypass the same-origin policy and see the server's raw response: whether Access-Control-Allow-Origin came back at all, whether it echoes a specific domain or *, and whether Access-Control-Allow-Headers lists your custom header. Distinguish simple requests from preflights too — custom headers or a JSON body trigger an OPTIONS preflight, which is where most failures happen. If curl works but the browser doesn't, the problem is 100% in the response headers.
Four frequent causes, in order: the Authorization prefix — a missing Bearer, an extra space, or wrong capitalization is the classic triple; header-name casing, harmless in HTTP/1 itself but sometimes sensitive to gateways and frameworks; an expired token with no detail in the response — decode the JWT's exp in this site's JWT tool before deciding to refresh or re-login; and cookie requests using credentials: include, where the server must echo a specific origin instead of the Access-Control-Allow-Origin: * wildcard.
The request never reached the API — typically the path got caught by a frontend route fallback or the gateway served an error page. The tool flags the Content-Type/body mismatch in a banner and extracts the HTML page title to help you recognize it; JSON responses get their top-level fields listed for a quick structural scan. The leading digit of the status code points the way too: 3xx may mean a login-page hijack, 5xx is a server-side fault. If nothing connects in proxy mode, also confirm the target's firewall isn't blocking this site's egress IP.
Environment variables store baseUrl and tokens per environment (dev/staging/prod); reference them as {{name}} in URLs and switch environments without editing the request. History auto-saves recent requests — click to refill — and frequent ones can be saved as collections. "Import cURL" and "Copy as cURL" convert in both directions. The timeout defaults to 30 seconds (adjustable in Settings); timeouts and manual cancels show distinct messages, and Raw+JSON bodies are syntax-checked before sending.
Related Tools
Related Articles
Unexpected token '<' is not valid JSON — 5 Reasons Your API Returned HTML Instead
fetch throws SyntaxError: Unexpected token '<' when the response body is HTML, not JSON. Covers the 5 root causes: SPA history fallback returning index.html, auth 302 redirects, gateway 502 error pages, wrong baseURL, and missing res.ok checks — with curl diagnostics.
API Testing: How to Send a Token and Fix CORS Errors
How to add an Authorization token when testing APIs online, and what to do about CORS / 405 / timeout errors? A step-by-step troubleshooting guide with our API tester.
What Is a CORS Preflight Request (OPTIONS)? A Cross-Origin Mechanism Every Frontend Developer Must Know
What is a CORS preflight? How simple requests differ from preflight, what Access-Control-Allow-* headers mean, credentials rules, common pitfalls, and how to use this site's API Tester in direct vs proxy mode.