API Request Tester

ToolsLibrary API Request Tester is a lightweight browser REST workbench. Configure method, URL, query params, headers, Bearer/Basic/API Key auth, and JSON or form bodies. View status, timing, and response headers with honest CORS guidance. Export cURL and replay from local history.

How to Use the API Request Tester

Build a REST request with method, URL, params, headers, auth, and body, send it from your browser, inspect the response, and export cURL or replay from history.

  1. Enter the request URL or pick a demo preset (httpbin GET or JSONPlaceholder).
  2. Select the HTTP method and add query params or headers in the key-value editors.
  3. Configure auth (Bearer, Basic, or API Key) and a JSON or form body when needed.
  4. Click Send and wait for status, timing, headers, and body in the response panel.
  5. Copy cURL to share the exact request, or open History to replay a prior run.
  6. Use Cancel to abort an in-flight request if the endpoint is slow.

CORS and browser limits

  • Cross-origin APIs must allow browser access via CORS — this tool cannot override server policy.
  • Localhost and public test APIs with open CORS (httpbin, JSONPlaceholder) work out of the box.
  • Preflight OPTIONS requests follow normal browser rules for non-simple methods and headers.

Worked example

Load the httpbin GET preset, click Send, and confirm a 200 JSON echo with your request headers. Then switch to POST with a JSON body against a CORS-enabled endpoint and compare response timing.

Privacy

Requests go directly from your browser to the target URL. History (including auth values) is stored locally — last 20 entries only. Clear history on shared machines before leaving.

Limitations

No server-side proxy — CORS-blocked APIs cannot be tested here without the API owner enabling CORS. cURL import is not yet available.

FAQ

Why do some APIs fail with a CORS error?

Browsers block cross-origin requests unless the API sends permissive CORS headers. This tool uses direct fetch — it works for CORS-enabled APIs (e.g. httpbin.org, JSONPlaceholder) and localhost APIs with open CORS. It cannot bypass server CORS policy.

Are my tokens saved?

Request history is stored locally in your browser (last 20 entries). Tokens and passwords in auth fields are included in saved history. Do not save secrets on shared devices.

Can I import cURL?

cURL export is available now. cURL import is planned for a future release.

Which HTTP methods are supported?

GET, POST, PUT, PATCH, DELETE, HEAD, and OPTIONS. Choose the method from the dropdown before sending.

How do I send JSON in the body?

Open the Body tab, select JSON mode, paste valid JSON, and send. The tool validates JSON syntax before the request is sent.

What auth types can I configure?

Bearer token, Basic username/password, and API Key (header or query placement). Auth values are applied to the outgoing request headers or params.

Can I copy the request as cURL?

Yes. After configuring the request, use Copy cURL to generate a command you can paste into a terminal or share with teammates.

Does the response panel show headers and timing?

Yes. Successful responses show HTTP status, duration in milliseconds, response headers, and a formatted or raw body depending on content type.

Can I replay a previous request?

Yes. Open History to reload any of the last 20 saved requests, then send again or tweak fields first.

Are demo presets available?

Yes. Quick presets load httpbin.org GET and JSONPlaceholder examples so you can verify the tool works before pointing at your own API.