REST Client

One input per line. Output is numbered to match the input order.
Pinned tools are listed in your favourites on the home page.Copies a link to this tool that carries your current input, so it opens ready to run.Gives you an iframe snippet for putting this tool on your own site.
Note: CORS applies — only CORS-enabled or same-origin APIs will work in the browser.

Collections are stored in this browser only and exported as files you download. Nothing you save here — URLs, headers, tokens or bodies — is ever sent to a server.

Any HTTP method, your own headers and body. Use this for ordinary JSON APIs.

Ctrl+Enter Run  · Ctrl+Shift+C Copy  · Esc Clear

Understand REST Client

Sends real HTTP requests from your browser tab and shows the status, timing, response headers, and body.

How it works

The request goes out through the browser's own fetch() API, which means it inherits every rule the browser applies to page-initiated requests. Response time is measured with performance.now() around the call, so it includes connection setup and browser overhead rather than being a pure server-side number. The response body is parsed and pretty-printed when the Content-Type says JSON, and left as raw text otherwise. Bodies are omitted for GET and HEAD, because the fetch specification forbids them there.

When to use it

  • Poking at your own API during development without installing a desktop client
  • Checking exactly what a public endpoint returns — status, headers, and shape — before writing code against it
  • Confirming that a bearer token or API key is accepted, and seeing the error body when it is not
  • Comparing a staging and a production endpoint response side by side

Watch out for

  • CORS applies. A browser will not let a page read a cross-origin response unless the server sends Access-Control-Allow-Origin, so plenty of working APIs will fail here with a network error that is not a server fault — use curl or a desktop client for those.
  • You cannot see every response header. Only the CORS-safelisted ones (Content-Type, Cache-Control, Content-Length, Expires, Last-Modified, Pragma, Content-Language) are readable cross-origin unless the server lists more in Access-Control-Expose-Headers.
  • Some headers cannot be set from a page at all. Host, Origin, Referer, Connection, and Cookie are forbidden header names — the browser sets them and silently drops your value.
  • Redirects are followed transparently, so a 301 shows up as the final 200 and the intermediate hop is invisible. Use `curl -i` without `-L` when the redirect itself is what you are debugging.

Not the right tool for: Requests that must carry cookies to another origin, or file uploads. Cookies are not sent cross-origin by default here, and multipart bodies need curl's `-F` or a desktop client with a file picker.

Frequently Asked Questions

Why is my API request failing with a CORS error?

Browsers block cross-origin requests from web apps unless the API includes Access-Control-Allow-Origin headers. If you control the API, add CORS headers. Otherwise, test with curl, Postman, or a CORS proxy. CORS is a browser security policy, not a server error.

Can I send multipart form data?

Currently the REST client supports JSON, text, and form-encoded bodies. For multipart (file uploads), use curl with -F flag or Postman which has native file picker support.

How do I authenticate with this client?

Add an Authorization header: "Bearer YOUR_TOKEN" for JWT/OAuth, "Basic BASE64(user:pass)" for HTTP Basic auth, or API-specific headers like "X-Api-Key: YOUR_KEY". The client does not store or transmit credentials outside your browser.

How to Use REST Client

  1. Paste or type your input in the input area above.
  2. The tool processes your input automatically or click Run.
  3. Copy or download the result using the action buttons.
  4. Use Ctrl+Enter to run quickly from the keyboard.