Why skip the heavy desktop apps?

We've all been there: you just need to check one endpoint, but your dedicated API client needs an update, or it's asking you to log in just to send a simple GET request. This tool is built for those "I just need to know if this works" moments. It runs right in your tab, doesn't require an account, and handles about 90% of the daily testing tasks a developer actually runs into.

Whether you're debugging a webhook, testing a new REST endpoint, or just curious about what a public API returns, you can build and fire a request in seconds.

The "Big Four" of any HTTP request

Every time you hit 'Send,' you're really just packaging four pieces of information:

• The Method: This is your intent. GET to read data, POST to create something new, PUT or PATCH to update existing records, and DELETE... well, you know what that one does.
• The URL: The address of the service you're talking to. Our tool handles query parameters separately so you don't have to manually build long, messy strings with ? and & symbols.
• Headers: This is the metadata. It's where you tell the server "I'm sending JSON" (Content-Type) or "Here is my secret token" (Authorization).
• The Body: The actual data payload. For most modern APIs, this will be a JSON object, but we support plain text and XML too.

Understanding the Response: What the server is telling you

The status code is the first thing you should look at. It's the server's shorthand for how things went:

• 2xx (Success): Everything went as planned. 200 OK or 201 Created are the ones you want to see.
• 4xx (Client Error): The server didn't like your request. Maybe the URL is wrong (404), you're not logged in (401), or your JSON is missing a required field (400).
• 5xx (Server Error): It's not you, it's them. The server crashed or is having a bad day. 500 Internal Server Error means there's a bug in the backend code.

The "CORS" Elephant in the Room

Because this tool runs directly in your browser, it's subject to the same security rules as any other website. If you try to hit an API and get a "Failed to fetch" error, it's very likely a CORS (Cross-Origin Resource Sharing) issue.

Browsers block requests from one domain (like ours) to another unless the other domain explicitly says it's okay. If you're testing your own API, you might need to enable Access-Control-Allow-Origin: * for development. If it's a public API you don't control, you might need to test it from a backend environment or a proxy instead.

Privacy and Security

Your API keys and sensitive data stay with you. This tool is 100% client-side. When you hit 'Send,' the request goes directly from your browser to the target URL. It never passes through our servers, we don't log your headers, and we certainly don't store your payloads. It's as private as if you were using curl in your terminal.