API Tools
Debugging an integration usually means answering three questions: what did I send, what came back, and what did the server mean by it. The API tools here help with each step without installing a desktop client.
4 free tools
API Tools
About these api tools
Send GET, POST, PUT, PATCH and DELETE requests straight from your browser and inspect status, headers, timing and body. Paste raw response headers to get an explanation of each one and a security-header checklist, or break a long URL into its components and edit its query string as structured data.
Why use them
No proxy in the middle
The API Tester sends requests directly from your browser, so tokens are never relayed through our servers. The trade-off is that the target API must allow CORS.
Header explanations
The Header Inspector recognises common caching, CORS, security and content headers and flags missing protections.
Round-trip query strings
Convert query strings to JSON, edit them, and convert back with correct percent-encoding and repeated keys.
Frequently asked questions
Why does my API request fail with a CORS error in the browser but work in curl?
Browsers enforce the Same-Origin Policy: a page may only read a cross-origin response if the server returns Access-Control-Allow-Origin headers that permit it. curl and server-side code are not subject to this rule. If the API does not enable CORS, use the cURL to Code converter to generate a snippet you can run locally instead.
Are my API keys stored?
No. Request headers, including Authorization, are kept only in the page's memory and are discarded when you close or reload the tab. They are never written to local storage or sent to analytics.
Can I test APIs on localhost?
Yes, as long as the local server responds with suitable CORS headers. Browsers may also block requests from an HTTPS page to a plain-HTTP address (mixed content), except for localhost in most modern browsers.