API Tester (REST & GraphQL)

Check an API quickly without installing anything. Send one request at a time and read the answer.

Private by design

Your inputs stay on your device and are not sent to our servers. Optional usage analytics does not receive your files or tool inputs.

API Tester

One request at a time, sent from your browser

10 of 10 left

Test only APIs you own or have permission to use.

Saved examples keep the URL, method, body and non-secret headers. Secret values are dropped.

Press Send to see the response here.

Examples and limits

Test only APIs you own or have permission to use.
Requests are sent by your own browser, so the API owner sees your address, not this site's.
10 of 10 requests left
The limit is 10 requests in any rolling minute.

Examples

If you see a CORS message, the API is not set up for browser calls. Ask its owner to allow this site.
Put keys in headers, not in the URL, so they stay out of history and logs.
Use a test key with the lowest access, never a production secret.

Each press of Send sends one request from your browser, with cookies off; nothing is relayed through this site. At most 10 requests in any rolling minute, shared by every open tab and kept across reloads. Authorization, cookie, key, token and secret values live only in memory.

Preparing tool

How to use API Tester (REST & GraphQL)

Choose REST or GraphQL, then type the URL and add any parameters, headers or body.
Press Send. Each press sends exactly one request, straight from your browser.
Read the status, time, size, headers and formatted body. Save the request as an example if you want.

Read the detailed guide →

What are the limits of API Tester (REST & GraphQL)?

Test only APIs you own or have permission to use. Requests go straight from your browser, so the API must allow browser (CORS) calls; nothing is relayed or proxied, so it cannot reach APIs that block browsers. At most 10 requests per minute, shared by all open tabs and kept across reloads, one per press, with no loops or repeats. Only http and https addresses; this site's own /api is refused. Authorization, cookie, key, token and secret values stay in memory and are never saved or put in links. Bodies over 2 MB are cut short.