API Tester - Test & Debug REST APIs Online Free

Test REST APIs online with GET, POST and other HTTP methods. Inspect status codes and JSON responses, add headers, and save requests locally. Requests go directly from your browser to the API, so browser CORS rules apply.

ENV

Request

KeyValue

Auth type

Type

KeyValue

Assertions run automatically after each request. Pass/fail shown below the response.

Collections

History

Response

Enter a URL and click Send to see the response here.

Tip: Use {{base_url}} in your URL and set it in Environment Variables.

Quick Tools: JSON Formatter JWT Decoder Base64 URL Encoder

About the API Tester

The ToolBrainy API Tester is a free, browser-based HTTP client for developers and QA engineers. Test REST and JSON APIs instantly — no sign-up, no installation, no server. Supports all major HTTP methods, query parameters, custom headers, five authentication types (Bearer Token, Basic Auth, API Key, OAuth 2.0), and six body formats. Environment variables let you switch between development, staging, and production endpoints with one click. The built-in code generator exports your request as cURL, JavaScript Fetch, Axios, Python Requests, PHP cURL, or Node.js. Requests, including any headers and body you enter, are sent to the target API. Collections, history and environment variables are saved in this browser’s local storage; the tool does not proxy API requests through ToolBrainy.

How to Use the API Tester

Set up environments — click Manage Variables to define {{base_url}}, {{token}}, or any key. Switch between Development, Staging, and Production instantly.

Build your request — select an HTTP method, enter the URL, then configure query params, headers, authentication, and request body in the matching tabs.

Click Send — the response appears on the right with syntax highlighting, status code, response time, and size. Switch between Pretty, Raw, Headers, and Cookies views.

Generate code — open the Code tab to copy a ready-to-run snippet in cURL, Fetch, Axios, Python, PHP, or Node.js. Save frequent requests to Collections.

Try a GET request without an API key

Select GET, enter https://jsonplaceholder.typicode.com/posts/1, leave authentication set to No Auth and click Send. This public demonstration API normally returns HTTP 200 and a JSON object containing fields such as userId, id, title and body. Its availability is controlled by the provider.

Compare Pretty and Raw to inspect the response. Headers shows the headers the browser is allowed to expose. For a POST test on an API you control, select POST and a JSON body, then check the API documentation for required fields and authentication. POST, PUT, PATCH and DELETE can change real data.

Understand API errors before changing your request

400: inspect the URL, required fields and JSON syntax.
401 or 403: check credentials, scopes and permissions. A 403 can also come from a gateway or security rule.
404: confirm the endpoint path and resource identifier.
429: check the API’s rate limits and retry instructions.
5xx: the API or an upstream service reported an error; retain the response details for debugging.
Failed to fetch: this alone does not prove CORS. Check browser developer tools for CORS, network, TLS or mixed-content errors. An HTTPS page may block an HTTP API request.

If you control the API, configure CORS for the intended origins, methods and headers. Otherwise use an authorized server-side or desktop client. Changing to no-cors does not make a blocked response readable.

Browser limitations and saved requests

This client cannot set every header or read every response header. Browsers hide Set-Cookie from JavaScript, and cross-origin APIs must expose additional headers through CORS. The Cookies tab is not a complete cookie inspector.

History and collections are local to this browser, not a synchronized account. Clearing site data may remove them. Review exported collections and code snippets before sharing because they may contain credentials or request bodies.

For details, see MDN’s CORS guide. Use the JSON formatter to review a response separately.

Why Use This API Tester

All HTTP methods — GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS in one place.

Environment variables — switch base URLs, tokens, and API keys between environments without editing every request.

5 auth types — Bearer Token, Basic Auth, API Key, OAuth 2.0 client credentials, or no auth.

Code generation — export as cURL, Fetch, Axios, Python, PHP, or Node.js with one click.

Collections and history — save requests, import/export Postman collections, replay from history.

Automated tests — add assertions (status code, body content, headers) that run after every request.

Use Cases

✓

API development and debugging — test new endpoints as you build, without leaving the browser.

✓

QA and integration testing — verify third-party APIs, add assertions, and catch regressions fast.

✓

Learning REST APIs — an ideal sandbox for students and beginners exploring how APIs work.

✓

Code snippet generation — generate language-specific client code from any tested request.

Frequently Asked Questions

Is this API tester free?

Yes, completely free with no sign-up or installation required. All requests are sent directly from your browser using the Fetch API.

Are my requests stored on a server?

The tool sends requests directly to the target API, which may log or store them. Collections, request history and environment variables are kept in this browser’s local storage. Use test credentials, and remove saved sensitive values on shared devices.

How do environment variables work?

Click "Manage Variables" to define key-value pairs like base_url = https://api.example.com. Then use {{base_url}} in your URL, headers, or body. Switch environments (Development, Staging, Production) in the top bar.

Why do some requests fail with a CORS error?

Browser-based HTTP clients are subject to CORS restrictions enforced by the target server. If the server doesn't include the required CORS headers, the browser blocks the response. This is a server-side limitation, not a bug in the tool.

Can I import a Postman collection?

Yes. Click "Import" in the Collections section and paste your exported Postman Collection JSON (v2.0/v2.1). Requests will appear in the Collections list.