What is an API tester?
An API tester is a tool that sends an HTTP request to an API endpoint and shows you
exactly what comes back. Instead of writing throwaway code or memorising curl flags every
time you want to check an endpoint, you fill in the method, URL, headers and body, press Send, and read
the status code, response headers and body directly.
That loop — change something, send, look at the response — is the core of API development. A good API tester makes it fast enough that you do it constantly: while building an endpoint, while integrating a third-party service, or while debugging why a request that works locally returns 401 Unauthorized in production.
What you can do with this API tester
- Send GET, POST, PUT, PATCH, DELETE, HEAD and OPTIONS requests to any public endpoint.
- Add custom headers such as
Content-Type,Acceptor vendor-specific ones. - Authenticate with a Bearer token, Basic credentials or an API key header.
- Send JSON bodies and format them with one click before sending.
- Read syntax-highlighted JSON responses instead of one unbroken line of text.
- See the status code, response time and payload size for every request.
- Copy any request as a cURL command to paste into a terminal, script or CI job.
How to test an API in four steps
1. Choose the HTTP method
Pick the verb that matches the operation. GET reads a resource, POST creates
one, PUT replaces one, PATCH updates part of one and DELETE
removes one. See the HTTP methods reference for the full semantics.
2. Enter the endpoint URL
Paste the full URL, including https://. Query parameters can go straight in the URL or into
the Params tab, which appends them for you and handles the encoding.
3. Add headers and authentication
Most JSON APIs expect Content-Type: application/json on requests with a body. If the endpoint
is protected, open the Auth tab and choose your scheme — a missing or malformed
Authorization header is the single most common cause of a
401 or 403.
4. Send and read the response
Check the status code first: 2xx means success,
4xx means your request was wrong and
5xx means the server failed. Then read the body, and check the
response headers when something looks off — Content-Type and rate-limit headers explain a
lot of surprising behaviour.
HTTP methods at a glance
| Method | Purpose | Has body | Idempotent | Safe |
|---|---|---|---|---|
GET | Retrieve a resource | No | Yes | Yes |
POST | Create a resource or trigger an action | Yes | No | No |
PUT | Replace a resource entirely | Yes | Yes | No |
PATCH | Apply a partial update | Yes | No | No |
DELETE | Remove a resource | Optional | Yes | No |
HEAD | Fetch headers only, no body | No | Yes | Yes |
OPTIONS | Discover allowed methods and CORS policy | No | Yes | Yes |
More testing tools
REST API Tester
Test REST endpoints with full control over methods, headers and bodies.
GraphQL Tester
Send queries and mutations to any GraphQL endpoint and inspect the result.
Webhook Tester
Understand and debug incoming webhook payloads.
JWT Decoder
Decode a JSON Web Token and read its header, payload and expiry.
JSON Formatter
Format, validate and minify JSON entirely in your browser.
Base64 Encoder
Encode and decode Base64 strings, including Basic auth values.
Frequently asked questions
Is this API tester really free?
Yes — free to use, no signup, no account, nothing to download. It runs in your browser.
Do you store my requests or credentials?
No. Requests pass through our proxy to reach the target API and are not logged or persisted. Your request history is kept in your own browser's local storage and never leaves your device.
Why does an online API tester need a server-side proxy?
Browsers enforce the same-origin policy, so a page on one domain cannot read a response from an API on another domain unless that API opts in with CORS headers. Most APIs don't. Forwarding the request through our server — which isn't subject to CORS — is what lets you test any public endpoint.
Can I test an API running on localhost?
No, and this is deliberate. Because the request is sent from our server rather than your machine, "localhost" would mean our localhost. Requests to loopback addresses, private network ranges and cloud metadata endpoints are blocked to prevent server-side request forgery. To test a local API, expose it on a public URL with a tunnelling tool first.
Is there a request size or rate limit?
Yes — 60 requests per minute per IP, a 2 MB request body and an 8 MB response, after which the body is truncated. These keep the service responsive for everyone.