HTTP Request Tester

HTTP Request Tester sends an API request from your browser and turns the whole exchange into a clean write-up you can paste anywhere: the request’s URL, headers and body, then the response’s status, headers and body, as Markdown or plain text. API keys, bearer tokens, cookies and passwords are replaced with REDACTED on the way out, so the write-up is safe to share. Paste a cURL command and you can export it without sending anything at all. No account, no proxy, nothing saved.

How to copy an API request as Markdown

1. Open Import a cURL command and paste one — from your browser’s Network tab (right-click a request, then Copy as cURL), from API docs, or from your terminal history. Or fill in the method, URL, headers and body yourself.
2. Press Send to include the response, or skip it: the write-up is ready either way.
3. In Export, choose Markdown or Plain text. Hide credentials and tokens is already on.
4. Copy it, or download it as a .md or .txt file.

Example: a request with secrets in it

This cURL command carries an API key in its URL, a bearer token in a header and a card token in its body:

curl 'https://api.shop.example/v2/payments?api_key=key_EXAMPLE_4f9a' \
  -H 'Authorization: Bearer tok_EXAMPLE_live_91c2' \
  -H 'Content-Type: application/json' \
  --data-raw '{"amount":4200,"currency":"gbp","card_token":"card_EXAMPLE_7d1e","customer":"cus_1042"}'

Sent, it came back as a declined payment whose response included a client_secret. This is the Markdown the tool writes — generated by the same code the page runs:

# POST https://api.shop.example/v2/payments?api_key=REDACTED

Sent 2026-09-30 14:03 UTC · **402 Payment Required** · 284 ms

## Request

**Method:** POST  
**URL:** https://api.shop.example/v2/payments?api_key=REDACTED

### Headers

| Header | Value |
| --- | --- |
| Authorization | REDACTED |
| Content-Type | application/json |

### Body

```json
{
  "amount": 4200,
  "currency": "gbp",
  "card_token": "REDACTED",
  "customer": "cus_1042"
}
```

## Response

**Status:** 402 Payment Required  
**Time:** 284 ms · **Size:** 118 B

### Headers

| Header | Value |
| --- | --- |
| content-type | application/json |
| x-request-id | req_8Hq2 |

### Body

```json
{
  "error": {
    "code": "card_declined",
    "message": "Your card was declined."
  },
  "client_secret": "REDACTED"
}
```

---

_Credentials and tokens were replaced with REDACTED._

The key, the token, the card token and the client secret are gone. The amount, the customer ID, the error code and the request ID — everything someone needs to help — are still there.

What gets hidden

• Credential headers: Authorization, Proxy-Authorization, Cookie, Set-Cookie, and API-key, auth-token and CSRF headers.
• Secrets in the URL: query parameters such as api_key, access_token, code, signature and X-Amz-Credential.
• Secrets in bodies, sent and received: fields named like password, token, secret, api_key or client_secret, in JSON and form data.
• JWTs anywhere, whatever they are called.
• Copies: once a value is known to be secret, every other appearance of it is removed too.

Names, email addresses and other personal details are not secrets in this sense and stay in. Read the write-up before you post it somewhere public. Turn the option off if you need the full values for yourself.

Where a write-up saves time

Bug reports and GitHub issues. “The API returns 500” gets a question back; the exact request and response get an answer. Markdown renders as tidy header tables and formatted JSON in GitHub, GitLab, Jira, Linear and Notion. Slack and Teams threads. Paste it to a colleague without leaking your token into a channel history that is searchable for years. Support tickets and emails to an API provider, where plain text reads better than Markdown symbols. API documentation, pull requests and runbooks, where a real request and response is the clearest example there is. Stack Overflow questions, where a leaked key is public within minutes.

Sending requests from your browser

Choose a method, enter the URL, add headers such as Authorization and a JSON, form or text body, and press Send. You get the status, time, size, body and headers straight away, and the write-up updates to include them. Requests go directly from your browser to the API, so they behave like a request from any web page — which brings one important limit.

When a request is blocked: CORS

A web page can only read an API’s response if the API allows it, using CORS headers such asAccess-Control-Allow-Origin. Postman and curl are not web pages, so the rule does not apply to them — which is why a request can work there and fail here. Most large public APIs allow browser requests, including GitHub, Stripe, OpenAI, Slack, Google, Spotify and Notion; many private and internal APIs do not. When a request fails, the tool checks whether the server answered at all and tells you which case it is, and the request can still be exported or copied as cURL to run in a terminal. To turn a command into code, use thecURL to Fetch converter; to clean a whole browser recording rather than one request, use the HAR Analyzer & Sanitizer.

What stays private

The request is sent only to the address you enter, directly from your browser. Your cookies for that site are never attached, so the page cannot act as you on it, and no Referer is sent. The write-up is made in the page. Nothing is stored — no history, no saved requests — so reloading starts again. This is the only page on the site allowed to connect to other websites; every other tool is blocked from doing so by its Content Security Policy.

Browser limits worth knowing

• Headers you cannot set: Cookie, Host, Origin, Referer and a few others are controlled by the browser. The page warns when you add one.
• Headers you cannot see: only the response headers the server exposes to pages are shown.
• Plain http:// is blocked from a secure page, except for localhost.
• GET and HEAD requests cannot carry a body in a browser.

Frequently asked questions

Last updated 30 September 2026