About the API Tester
Browsers block scripts from reading responses of other origins, which is why a request tool on a web page needs a relay. This one sends your request from our edge function to the URL you specify, with the method, headers and body you compose, and returns the status line, response time, every response header and the body, pretty-printed when it is JSON. It is enough for the everyday cases: checking that an endpoint is up, seeing the shape of its response, trying a POST with a small payload, or reproducing a bug report.
The relay forwards the headers you type, except hop-by-hop and cookie headers, and never adds credentials of its own. An Authorization header you enter is sent to the target exactly once and is not kept; still, prefer test keys, since the request leaves your machine. Bodies are limited to 64 KB and responses to 512 KB, and private or internal addresses are refused.
Nothing is stored on our side. For a quick look at a page's headers without composing a request use the header checker; to format a saved response use the JSON formatter.
How to use
- Choose the method and enter the URL.
- Add headers one per line as Name: value, for example Accept: application/json.
- For POST, PUT or PATCH, type the body in the field; JSON bodies get a JSON content type automatically.
- Press Send and read the status, headers and formatted body.
Common questions
- Is my API key safe?
- It is forwarded to the target once and not stored, but it does travel through our function. Use a test or scoped key when you can, as you would with any hosted request tool.
- Why does the API answer differently than from my app?
- The request comes from a Cloudflare address without your cookies. APIs that check origin, IP allow lists or session cookies will respond accordingly.
- Can I send form data or files?
- Text bodies only, up to 64 KB. Set Content-Type: application/x-www-form-urlencoded in the headers and write the body as key=value pairs for form posts.