AI and language model APIs
OpenAI API Tester
Send authenticated requests to the OpenAI API and read the response, including how its error envelope reports a bad key.
Gemini API Tester
Test Google's Gemini API with an x-goog-api-key header and interpret its status-field error responses.
Anthropic API Tester
Call the Anthropic API with the required x-api-key and anthropic-version headers.
Platform and messaging APIs
Slack API Tester
Call Slack Web API methods and understand why a failure arrives as HTTP 200 with ok: false.
GitHub API Tester
Test the GitHub REST API with a personal access token, and see why private resources return 404 rather than 403.
Discord API Tester
Test bot endpoints and webhooks — note Discord uses Authorization: Bot, not Bearer.
Telegram Bot API Tester
Call Bot API methods, where the token lives in the URL path rather than a header.
Google and Meta APIs
Generic testers
API Key Tester
Check whether any API key or token is valid, against any provider.
REST API Tester
Full control over method, headers, body and authentication for any REST endpoint.
GraphQL Tester
Send queries and mutations to any GraphQL endpoint.
Webhook Tester
Understand, verify and replay webhook payloads.
Before you paste a production key
These testers send your request through api-tester.com's server. That is not a design preference — a browser cannot read a response from a third-party API unless that API opts in with CORS headers, and most do not. Forwarding through our server is what makes testing possible at all.
The practical consequence is that any key or token you enter transits our infrastructure. We do not log
or store it, but that is a promise you cannot verify from a browser tab, so treat it the way you would
treat any third-party tool: prefer a test, scoped or restricted key over one with full production
permissions, and rotate anything you are unsure about. Every request can also be copied as a
curl command, which lets you run it from your own machine and skip us entirely.
Credentials that appear in a URL rather than a header — Telegram bot tokens, Google Maps keys, Discord webhook URLs — are stripped out before your request history is saved, so they are not left sitting in your browser's local storage. See the privacy page for exactly what is and is not kept.
Reading errors from these providers is most of the work. The 401, 403 and 429 reference pages cover the three you will hit most, and the guide to API authentication methods explains why different providers ask for credentials in such different ways.