Why this exists
Checking one API endpoint should not require installing a desktop application, creating an account, or joining a workspace. Most of the time you want to send a single request, look at the response, and get on with your day — while building an endpoint, integrating a third-party service, or working out why something that works locally returns 401 in production.
So the API tester is a single page with a method dropdown, a URL box and a Send button. Everything else — headers, authentication, query parameters, request body, history — is one tab away. It loads fast, works on a phone, and does not ask you for anything before letting you use it.
What the site includes
- The main API tester, plus focused variants for REST, GraphQL and webhooks.
- A complete HTTP status code reference, one page per code.
- Reference guides in Learn, covering HTTP methods, HTTP headers and REST API testing.
- Small single-purpose tools — a JWT decoder, JSON formatter, Base64 encoder, URL encoder and UUID generator — that run entirely in your browser without contacting the server at all.
How it works
Browsers enforce the same-origin policy, so a web page cannot read a response from a third-party API unless that API opts in with permissive CORS headers. Most APIs do not. So requests you send are forwarded through this site's own server, which is not a browser and is not bound by CORS, and the response is handed back to the page. That is the only reason a server is involved at all.
Requests passing through the proxy are not logged and not stored. Your request history lives in your own browser's local storage and never leaves your device. Credentials entered in the Auth tab are used to sign that one request and are never persisted. The privacy page describes all of this in detail, including the one thing that is retained — standard web server access logs.
Deliberate limits
| Limit | Value | Why |
|---|---|---|
| Rate limit | 60 requests per minute per IP | Keeps the service responsive and unattractive as an attack relay |
| Request body | 2 MB | Bounds memory use per request |
| Response body | 8 MB, then truncated | Same, and nobody reads 8 MB of JSON in a browser pane |
| Timeout | 30 seconds | A slow target should not tie up a connection indefinitely |
| Redirects | 5, each re-validated | Prevents redirect loops and redirect-based proxy bypasses |
| Private addresses | Blocked | Prevents server-side request forgery — see below |
Why localhost does not work
Because the request is made from this site's server rather than from your machine, localhost
would mean our localhost. Requests to loopback addresses, private network ranges and cloud metadata
endpoints are blocked, and every hop of a redirect chain is re-validated so a 302 cannot be used
to sneak past the check. That is a security requirement, not an oversight. To test a local API, expose it on
a public URL with a tunnelling tool first, or use a local client.
What it is not
This is an exploratory tool, not a test automation platform. It has no collections, no environments, no shared workspaces, no scripting, no CI runner and no team accounts. Those are genuinely useful features and other products do them well — but they need accounts and state, and adding them would mean becoming a different kind of product.
The bridge to automation is the Copy as cURL button. Get a request working here, copy it, and paste it into a shell, a script or a CI job. The REST API testing guide covers where manual exploration ends and automated regression testing should begin.
Accuracy and corrections
The reference content follows the current HTTP specifications — RFC 9110 for semantics, RFC 9111 for caching,
RFC 5789 for PATCH — rather than the older RFC 2616 material that much of the web still repeats.
Where common practice diverges from the spec, the guides say so instead of pretending otherwise.
Mistakes are still possible. If you find something wrong on a reference page, or an endpoint that behaves oddly through the tester, corrections are welcome and get fixed rather than argued about.
Cost and independence
The site is free and has no paid tier, no upsell and no signup wall. It sets no cookies, runs no analytics and loads no third-party scripts — not as a marketing position, just because a tool this small does not need them. It runs on a single modest server.
Start with the API tester itself, browse the guides, or read the privacy policy for exactly what happens to a request you send.