API Tester Online: Send HTTP Requests & Copy cURL

Build HTTP requests, inspect timing, headers, and responses, and copy cURL without sending request data through BrakeTools.

This sends the actual HTTP request straight from your browser tab using fetch, not through a server-side proxy, which means the response you see is exactly what your browser received and nothing more got quietly relayed in between. It also means the request is bound by the same CORS rules any other page's JavaScript would be, which is the part a lot of quick API testers gloss over until a request mysteriously fails.

How to test an API online

  1. Paste the endpoint into the URL field and pick a method: GET, POST, PUT, PATCH, DELETE or HEAD.
  2. Add header rows such as Authorization or Accept; when sending JSON, add Content-Type: application/json yourself, since the tool does not set it for you.
  3. For POST, PUT, PATCH or DELETE, type the raw request body into the body field that appears for those methods.
  4. Click Send and read the status code, the elapsed milliseconds, the response headers the browser exposes, and the body as plain text.
  5. If the browser blocks the call, copy the generated cURL command and run it in a terminal instead.

What actually happens when you press Send

GET, POST, PUT, PATCH, DELETE, and HEAD are all supported, with a request body field that only appears for methods where sending one makes sense — GET and HEAD requests never carry a body, matching how browsers themselves handle those methods. Custom headers are added as key/value rows and passed through to fetch exactly as typed, so a header name with a typo shows up as a typo in the actual request rather than being silently corrected.

The response panel shows the HTTP status code, elapsed time measured from just before the request fires to just after the body finishes downloading, every response header the browser exposes, and the raw response body as text.

Why a request can fail here even when the API works fine elsewhere

Because the request genuinely originates from JavaScript running on this page, the target server has to explicitly allow this page's origin via CORS response headers, or the browser blocks JavaScript from reading the response — even if the request itself reached the server and the server responded successfully. This is standard browser same-origin policy, not a limitation specific to this tool, and it's exactly the same restriction any other browser-based API client runs into.

A request that fails here with what looks like a network error is often actually a CORS rejection: the server has to opt in with the right Access-Control-Allow-Origin header (and, for some request shapes, has to correctly answer a preflight OPTIONS request first) before a browser tab is allowed to read anything back. There's no way for a client-side tool to bypass that from inside the browser — that restriction exists specifically to stop arbitrary web pages from reading responses from origins that haven't opted in.

Testing localhost and private APIs

Pointing the URL at http://localhost:3000, 127.0.0.1 or a machine on your office network means clearing two browser rules before your server code even runs. The first is CORS: your local server has to reply with an Access-Control-Allow-Origin header that allows https://braketools.dev (or *), and it has to answer the preflight OPTIONS request that JSON content types and custom headers trigger.

The second is that this page loads over HTTPS. Browsers restrict HTTPS pages from fetching plain http:// URLs as mixed content, they differ in how they treat loopback addresses like localhost, and recent versions may prompt for permission or refuse outright when a public website tries to reach a private network address. The outcome therefore depends on your browser and its version rather than on anything this tool controls.

When a local request fails with a bare network error, the browser console names the exact rule that stopped it. The copied cURL command is the dependable fallback, because a terminal request is subject to none of these page-level restrictions.

The cURL command is the workaround, not a decoration

Every request you build also renders as an equivalent cURL command, properly quoted, with the Copy button right next to it. Running that command from a terminal instead of a browser tab isn't subject to CORS at all, since CORS is a browser-enforced restriction on JavaScript, not a rule the server itself imposes on every possible client — so the cURL export is the practical way to actually complete a request that this page's own Send button gets blocked on.

A lightweight Postman alternative

What you get is the core request loop with nothing to install and no login: choose a method, set headers and a raw body, send straight from the browser without a relay server, inspect the status, timing, headers and body, and export the call as cURL.

What you don't get is everything built around that loop in a desktop client: saved collections, environments and variables, request history, OAuth or other auth helpers, form-data and file-upload builders, pre-request scripts and test assertions, and pretty-printed JSON. Nothing is saved between visits either, so reloading the page discards the request — keep the cURL command if you plan to run it again.

What never gets seen by anything but the two endpoints involved

The request goes directly from your browser to the URL you typed; BrakeTools itself never receives the URL, headers, body, or response, since there's no server-side component in the request path at all. That also means there's no safety net here the way there might be with a hosted API client — if you paste an authorization token or an API key into a header field on a shared or public computer, it's exposed exactly as much as it would be typing it into that API directly. Treat this the same way you'd treat any browser tab that can see your clipboard.

Questions people ask about API Request Builder & Tester

Why do I get a CORS error even though the API works in Postman?
Postman and similar desktop clients aren't running inside a browser, so CORS — a restriction browsers enforce on JavaScript specifically — doesn't apply to them at all. This tool runs its request from actual browser JavaScript, so it's subject to the same CORS rules any web page would be; the API itself hasn't changed, only whether the client is a browser.
How do I test an API that doesn't support CORS?
Use the generated cURL command instead, copied with the button next to it, and run it from a terminal. A terminal request isn't made by browser JavaScript, so it isn't subject to CORS at all — that restriction exists specifically to control what web pages are allowed to read, not what any HTTP client anywhere can send.
Does this tool proxy my request through its own server?
No. The request is sent directly from your browser to the URL you entered using the standard fetch API, with no server-side relay in between. BrakeTools never sees the URL, headers, body, or response at any point in that exchange.
Is it safe to test an endpoint that needs an API key or auth token?
The key never leaves your browser except in the request you send to the actual API, so nothing is logged or stored by this tool. It's still visible in your browser's memory and network panel like any client-side request, so avoid testing with a live production credential on a shared or public computer.
Can I test a localhost API from this tool?
Sometimes. Your local server must send CORS headers allowing this site, and your browser has to permit an HTTPS page reaching an http:// loopback or private address, which varies between browsers and versions. If the request is blocked, run the copied cURL command from your terminal instead.
Is this a free Postman alternative?
For quick one-off requests, yes: it is free, needs no install or account, and sends requests directly from your browser. It lacks Postman's collections, environments, history, auth helpers and scripting, so it suits checking an endpoint rather than managing a whole API workspace.
Do I need an account to send API requests?
No account, sign-in or email is involved. The request exists only in this tab while you work on it and is not saved anywhere, so closing or reloading the page clears the URL, headers and body you entered.

Related tools on BrakeTools

Content reviewed 2026-09-27.