Free HTTP API Client - Browser Fetch and Public-Host Proxy

An API tester - also searched as an HTTP client, REST client, or online Postman alternative - is a form that sends a request you are allowed to make and shows the status, headers, and a truncated body. This page offers two modes. Browser mode is ordinary fetch from your tab, so CORS and mixed-content rules apply. Proxy mode posts to /api/api-tester, which only allows public HTTP(S) hosts, strips hop-by-hop headers, uses an 8 second timeout, and does not follow redirects.

The default GET https://jsonplaceholder.typicode.com/todos/1 typically returns status 200 and a todo object with id 1. That is the worked check when the demo host is reachable. JSONPlaceholder is a public demo API. It is not your production backend.

Use this on APIs you own or have permission to call. It is not a port scanner, fuzzer, credential stuffer, or exploit helper. If the request is for unauthorized access, do not send it.

A public GET takes a few seconds when the demo host is up:

1. Enter an authorized URL - The default GET uses https://jsonplaceholder.typicode.com/todos/1 as a public demo. Only call URLs you own or have permission to test.
2. Choose method and mode - Pick GET, HEAD, POST, PUT, PATCH, DELETE, or OPTIONS. Browser mode is limited by CORS. Proxy mode only allows public HTTP(S) hosts and refuses private networks.
3. Add headers and body - Headers are Name: value per line. The body field is ignored for GET and HEAD. Click Send.
4. Read the response - Status, headers, timing, and a truncated body. Do not use this against systems you do not own or have permission to test.

Keep browser mode and the default URL, then click Send. When the demo host is reachable you should see a 200 and a todo object.

GET https://jsonplaceholder.typicode.com/todos/1
Accept: application/json

{
  "userId": 1,
  "id": 1,
  "title": "delectus aut autem",
  "completed": false
}

If browser mode fails with a CORS error, that is the browser enforcing Access-Control-Allow-Origin, not a bug in the form. JSONPlaceholder usually allows this origin. Many production APIs do not. Switch to proxy only for public hosts you are authorized to call - never for localhost or RFC1918.

Pick the mode that matches the constraint you actually have:

The general rule: browser mode for CORS-open public demos, proxy mode for public hosts without CORS, never private networks.

Redirects are not followed by the proxy (manual) so a public host cannot bounce you onto a private IP. Cookie, Cookie2, Host, Connection, and other hop-by-hop names are stripped. Authorization from this form is not a session-riding helper for your logged-in bank tab. Request bodies larger than 64 KB are rejected by the proxy. Responses are truncated at 64 KB in both modes so a huge payload cannot freeze the page.

Draft URL, method, mode, headers, and body are stored under api-tester-data for up to 30 days in this browser. Panel width uses api-tester-panel-width. The split class api-tester-split-track is unique. Do not save live production secrets in a browser origin you share. Click Clear to restore the JSONPlaceholder GET.

Browser mode uses fetch with cache: "no-store" and without credentials. A simple GET with Accept: application/json often stays a "simple" request. Custom headers, PUT/PATCH/DELETE, or a JSON content-type can trigger a CORS preflight (OPTIONS). If the target does not answer that OPTIONS with matching Allow-Origin, Allow-Methods, and Allow-Headers, the tab never sees the real response. The form surfaces that as a failed fetch. Switching to proxy does not "fix CORS" in your users' browsers; it only lets this site's server perform a public HTTP call. Your production SPA still needs the API to grant the SPA's origin.

GET and HEAD ignore the body field on purpose. HTTP clients that attach a body to GET confuse caches and some servers. POST, PUT, and PATCH send the textarea as the raw body - not automatically JSON-encoded. If you need Content-Type: application/json, add that header line yourself and paste valid JSON. OPTIONS is available for seeing what a public host returns to a preflight-like call; it is not a port probe. HEAD is for length and headers when you do not want a body.

The proxy calls assertPublicHostname so localhost, RFC1918 (10/8, 172.16/12, 192.168/16), and link-local targets are refused. That is SSRF hygiene: a website that will fetch any URL the visitor types becomes a way to scan internal admin panels. Redirects use manual so a public 302 cannot bounce onto a metadata IP. The User-Agent is set to DevOkk-ApiTester/1.0. Hop-by-hop headers and Cookie are stripped so this form cannot ride your logged-in session on another site. Eight seconds is enough for JSONPlaceholder and not enough for a slow internal crawl.

Drafts remember URL, method, mode, headers, and body because repeating a staging GET is convenient. They are still only on this device. If you pasted a bearer token into the header box, treat Clear as mandatory when you walk away from a shared computer. Authorized URLs only remains the rule even when the proxy would technically allow the host.

Header lines must contain a colon. A line that is only Authorization throws before any network call. Duplicate header names: the last value wins in both modes because Headers.set overwrites. Do not try to smuggle hop-by-hop names through the proxy; they are dropped. Mixed content (HTTPS page calling HTTP) may be blocked in the tab even when the host is public - another reason people reach for the proxy, which is still limited to http and https on public DNS names.

Truncation is a UI safety rail, not a streaming API. If you need the full 2 MB JSON dump from an export endpoint, use curl or a local HTTP client you installed. This page is for status, a handful of headers, and enough body to see whether the JSON shape matches what you expected from JSONPlaceholder's todo. Timing is performance.now around the fetch; it includes download of the truncated body, not a TTFB waterfall. It is a stopwatch, not WebPageTest.

Clear restores GET, browser mode, the JSONPlaceholder URL, Accept: application/json, and an empty body. Send stays disabled while a request is in flight so double-clicks do not pile up. Copy is on the response panel and writes status, timing, headers, and body together so a bug report can paste one block. Fullscreen hides the article and shows only the response, matching the JSON Formatter workbench pattern with a unique api-tester-split-track class.

Browser mode never uploads the request to DevOkk except as your own tab talking to the URL you typed. Proxy mode does send the URL, method, headers, and body to /api/api-tester so the server can fetch a public host. That is the point of the proxy. Do not put customer tokens in that body unless you are authorized and the host is public. Localhost and private ranges are refused on purpose.

This is not a pentest platform. Authorized use only.