API client
Send one HTTP request and read the answer — straight from your browser, no account, no proxy.
Query parameters — edits here are written back into the URL above.
Only the headers you add here are sent. Authorization is just another header — there is no login flow.
GET and HEAD do not send a body. What you type here stays in the editor, it is simply not sent.
Requests go straight from your browser to the address you type — never through our servers. Nothing is saved, written to the address bar or logged.
Send a request to see the status code, headers and body here.
The same request as code — the way out when the browser blocks the response (CORS).
How to use it
- Pick the method, paste the endpoint, then press Send (or ⌘ / Ctrl + Enter). Nothing is sent before that.
- Fill in Params, Headers and Body as needed — the number on each tab is how many rows are actually enabled.
- The first response line gives the status code, total time and size; JSON bodies are indented automatically.
- Blocked by CORS? Open Code and copy the identical request as curl, fetch or Python to run in a terminal.
- Reset clears everything, and so does reloading the page — no request is ever saved.
Example
Request
GET https://httpbin.org/anything?from=en&id=1
Response
200 OK · 124 ms · 1.2 KB · application/json
{
"args": { "from": "en", "id": "1" },
"method": "GET"
}Every value on the right comes from the server — this tool only formats it. The Code view has the same request as curl, which gives the same answer in a terminal.
Rules, limits and known issues
- There is no proxy. When the target does not send Access-Control-Allow-Origin, the browser hides the response from this page — the request may still have reached the server. Use the Code view to run it locally.
- localhost, intranet addresses, and http:// URLs called from this https page are blocked by the browser, not by this tool.
- Cookies are never sent (credentials are omitted), so APIs that rely on a session need the token in a header.
- Set-Cookie, redirect chains, raw bytes and DNS/TLS timings are not available to the browser and are not shown here.
- No history, collections or environments: reloading clears everything, and nothing is written to the address bar, storage or logs.
- Request bodies are text only, up to 64 KB; file uploads are out of scope.
- The size shown is the decoded body; the time shown is the total, not time to first byte.
- HTTP only — WebSocket, SSE and gRPC are out of scope (GraphQL still works as a POST with JSON).
Related tools
Handy next to an API client.