Curl in the browser - no Postman, no CORS
Type a URL, pick GET / POST / PUT, add headers and body - click. The request goes from our server, so CORS doesn't block and you don't need to install Postman.
You get the status code, response headers, body (auto-formatted JSON / XML / HTML), size (compressed + decompressed), set-cookie plus the timing breakdown: DNS / TTFB / transfer.
Great for API debugging: webhooks, OAuth, third-party endpoints, checking cache or CORS headers - without leaving the browser.
How to use it
- Pick the method (GET / POST / PUT / PATCH / DELETE / HEAD / OPTIONS) on the top bar.
- Paste the target URL (must start with https:// or http://).
- In the Headers tab add your own headers (e.g. Accept: application/json, X-API-Key).
- In the Body tab pick a format: JSON, form-data, x-www-form-urlencoded or raw. Type the data.
- In the Auth tab pick Basic (user + password) or Bearer (token). The Authorization header is built automatically.
- Hit Send. On the right you see the status, headers, body, timing and cookies.
- Turn on Follow redirects only when you want to see the whole 3xx → 200 chain. Each redirect is re-validated for SSRF before we follow it.
When this is useful
An HTTP request tester solves day-to-day frontend and backend problems:
- API debugging. Does the endpoint respond at all? Does it return what the docs promise? One shot, full picture.
- CORS that browser fetch can't beat. Your fetch in devtools throws a CORS error? From our server CORS doesn't exist - you see the actual server response, not the browser's wrapper around the error.
- Webhook receivers. POST to your own webhook, see what arrives and in what shape.
- OAuth / Bearer tokens. Check whether the token is valid - GET /me with Authorization: Bearer ... and read the response.
- Basic Auth. Probe endpoints behind Basic (admin panels, legacy APIs).
- Performance triage. TTFB too high? Transfer longer than expected? You see it broken down.
- Redirect chains. Domain does 3 hops before the page? The hop list shows each one.
- Cache header checks. Cache-Control, ETag, Last-Modified - full list of response headers.
- OPTIONS preflight. CORS preflight with a real Origin and Access-Control-Request-Method, so you see exactly what your server returns.
Related: catch incoming webhooks in the webhook receiver, stub responses with the mock API generator, or generate request types straight from an OpenAPI spec.
Questions and answers
Because browsers block cross-origin requests (CORS). From our server CORS doesn't apply - it's a regular fetch from Node.js. Plus: some servers return different headers to a browser than to curl/Node (e.g. User-Agent gating), so you see the real response, not the polite one for browsers.