API Tester (Online REST Client)
Compose API requests, test them with browser fetch first, fall back to a secure proxy when CORS blocks, and export requests as cURL or fetch snippets.
Updated
Request builder
Query parameters
Headers
Auth helper
Credentials are encoded in your browser and are only saved if you enable sensitive history.
Export
Generate snippets from your current request.
History
Default history stores method + URL + timestamp only. Authorization values are redacted when sensitive history is enabled.
No saved requests yet.
Response
Send a request to inspect status, timing, headers, and response body.
How to use API Tester (Online REST Client)
API Tester (Online REST Client) helps you build and run HTTP requests quickly without leaving the browser. Configure method, URL, query params, headers, auth, and JSON body, then inspect status, timing, headers, and payload in one workspace. Requests run directly from your browser by default for privacy and realism; if browser CORS blocks the call, you can explicitly retry the same request through the guarded server proxy route. The tool also keeps a local request history, redacts sensitive fields by default, and exports copy-ready cURL/fetch snippets for reproducible debugging.
- Choose a method and enter the target endpoint URL, then add query rows so the URL and param table stay synchronized.
- Fill header rows, choose None/Bearer/Basic in Auth helper, and add a JSON body when the selected method supports one.
- Use Validate & prettify JSON to confirm body syntax; Content-Type is auto-added when valid JSON has no explicit header.
- Send the request with browser fetch first, then click Send via server proxy if you see a CORS/network fallback notice.
- Review status, duration, size, headers, and body, then copy cURL/fetch snippets or restore prior requests from history.
Your data never leaves your device — 100% private processing.
Privacy model: browser-first requests with explicit proxy opt-in
Unlike many REST clients that route every request through a backend relay, this tool starts with direct browser fetch so the destination server sees your request exactly as a real frontend would send it. That improves debugging fidelity for CORS, cookies, and origin-bound behavior while reducing unnecessary server handling. When browser restrictions prevent a response (common with third-party APIs that do not allow your origin), the interface offers an explicit proxy fallback button instead of silently switching transport paths. This keeps control with you: browser-first for privacy and realism, proxy only when you intentionally choose it for troubleshooting.
Reducing accidental secret retention in request history
API debugging often involves temporary tokens, API keys, or test credentials. To avoid accidental persistence, history is minimal by default and stores only method, URL, and timestamp. You can enable extended history when needed, but Authorization and similar sensitive headers are redacted before storage so obvious secrets do not linger in plaintext localStorage. This split model gives teams practical convenience for repetitive testing while keeping defensive defaults for shared machines, recorded demos, and screenshots. It also lowers the risk of leaking credentials through copied history entries or browser profile exports.
When cURL and fetch exports accelerate incident response
Well-formed reproduction commands are often the fastest path to fixing API issues. The export actions generate cURL and fetch snippets directly from your current request state, including method, URL, headers, and body. That allows support engineers, backend developers, and QA testers to replay the exact failing request in their preferred environment without manually retyping fields. During incident response, sharing one canonical command eliminates ambiguity around payload formatting and header casing, making it easier to compare behavior between browser, proxy, staging, and production systems.
Worked examples
Browser fetch success case
Inputs: GET https://api.example.com/users?page=1
Result: 200 response with headers/body shown in one panel
CORS fallback troubleshooting
Inputs: PUT cross-origin URL + Authorization header
Result: Browser TypeError notice then successful proxy response view
Request export for ticket
Inputs: POST JSON payload with custom headers
Result: Copy-ready cURL and fetch snippets for reproduction
Glossary
- CORS
- Cross-Origin Resource Sharing rules that determine whether browser JavaScript can read responses from a different origin.
- Prettified JSON
- A formatted JSON representation with indentation that improves readability during request and response debugging.
- Basic authentication
- HTTP auth scheme that sends base64-encoded username:password credentials in the Authorization header.
- Request history redaction
- Masking sensitive header values before local persistence to reduce accidental secret exposure.
- Proxy fallback
- An optional server-side request path used when direct browser fetch is blocked by CORS or network policy.
Related reading
Frequently Asked Questions
Get weekly tool tips & updates
New tools, power-user tips, and productivity hacks — delivered free every Friday.
No spam, ever. Unsubscribe with one click.
Why use API Tester (Online REST Client)?
- Build complete HTTP requests with method, URL, params, headers, auth helpers, and body editing in one pane
- Run browser fetch first, then fallback to server proxy only when CORS or network constraints require it
- Inspect response status, duration, size, headers, pretty JSON, and binary/base64 payload behavior quickly
- Export current requests as cURL and fetch snippets to share exact repro steps with teammates
Common use cases
- Reproduce API integration bugs by mirroring frontend request shape and comparing response headers
- Validate auth header construction for Bearer and Basic flows before wiring requests into production code
- Debug CORS-limited third-party APIs by retrying through a controlled proxy path when browser fetch fails
- Capture and restore recent requests while keeping bodies/secrets out of local history unless explicitly enabled
Related Developer Tools
CORS Tester / Preflight Checker
Run a real preflight and follow-up request against any endpoint, then verify Access-Control headers for origin, methods, headers, and credentials.
cURL Converter
Convert a curl command to JavaScript fetch, Node, Python requests, or PHP. Paste your curl and get clean client code instantly. Free and private.
HTTP Debug & Test Endpoints
Test real HTTP clients against permanent debug endpoints for status codes, echo payloads, redirects, headers, gzip, and SSE from one base URL.
JSON Formatter & Validator
Format, validate, and minify JSON instantly. Includes syntax highlighting, error detection, and a collapsible tree view — free, private, in-browser.
Regex Tester
Test and debug regular expressions online. See live matches, capture groups, and replace output. Free, private, instant.
Base64 Encoder & Decoder
Encode text or files to Base64, or decode Base64 strings back to text. Fast, free, and runs entirely in your browser.
Explore all Developer Tools.