API Tester
Compose a request and read back exactly what the server returned — status, timing, size, headers and body. The call goes straight from your browser to the API; nothing is routed through our servers.
Browsers silently drop forbidden headers — Host, Content-Length,
Origin, Cookie, Connection and friends. The request
still goes out, just without them.
GET and HEAD requests are sent without a body — the fetch spec forbids it.
Sent as Authorization: Bearer <token>.
Encoded to Authorization: Basic … — base64, not encryption.
Up to 20 requests are held in this tab memory until you leave. No request content is saved to browser storage. Clear history also removes history saved by earlier versions.
Response headers 0
Cross-origin responses expose only a handful of headers unless the server sends
Access-Control-Expose-Headers — an empty list here does not mean an empty response.
—
The browser blocked this request.
The request itself may be perfectly valid — the browser just refused to hand over the response. To check it outside the browser, paste it into cURL to Code and run the equivalent command from your terminal or a server, where no same-origin policy applies.
Why a request can fail here but work in cURL
This tool uses the browser's own fetch(), which means it inherits the same-origin
policy. A response only becomes readable if the API opts in with an
Access-Control-Allow-Origin header. When it doesn't, the network tab shows a
perfectly good 200 while JavaScript sees only a generic TypeError — the browser
deliberately withholds the details so a page can't probe your internal network.
That restriction is a browser security boundary, not a limitation of this tool, and every
in-browser API client runs into it. APIs built for browser consumption — GitHub, Stripe,
Supabase, most SaaS platforms — send the right headers and work fine here. Internal services
that only ever talk to servers usually don't, and for those you want a real HTTP client such as
cURL, Postman or curl in a shell.
What the numbers mean
Time is measured from just before fetch() to the moment the whole
body has been read — DNS, TLS, the server's own thinking time and the transfer, all in. It is
wall-clock time on your connection, so it will differ from the server's own logs.
Size is the number of bytes actually delivered after decompression, which is
why it can disagree with Content-Length for gzipped responses.
FAQ
Is my request — including tokens — sent to BasaltKit?
No. There is no backend. The browser opens a connection directly to the URL you typed, so keys, cookies and payloads never pass through this site. Treat the history list as you would the browser's own memory: convenient, local, and worth clearing on a shared machine.
Why is the response header list almost empty?
For cross-origin requests the browser only exposes the CORS-safelisted headers —
Content-Type, Content-Length, Cache-Control,
Date, Expires, Last-Modified, Pragma —
plus whatever the server explicitly lists in Access-Control-Expose-Headers.
Everything else arrived, but JavaScript is not allowed to read it.
Which APIs can I try right now?
Anything that allows cross-origin reads. Public examples that work: GET on
https://api.github.com/repos/withastro/astro,
https://jsonplaceholder.typicode.com/posts/1 or
https://httpbin.org/get. A POST to
https://httpbin.org/post with a JSON body echoes back exactly what was sent —
a good way to confirm headers and payload arrive intact.
Why did my custom User-Agent or Cookie header disappear?
Those names are on the fetch spec's forbidden list, and the browser strips them without an
error — a page must not be able to forge the headers that identify it. Cookie is
the one exception that can be sent, but only by ticking Send cookies, and only if the
server opted into credentials with Access-Control-Allow-Credentials.
Why does an http:// URL do nothing?
This site is served over HTTPS, and browsers block requests from a secure page to an insecure one — mixed content. Point the request at the API's HTTPS endpoint, or run it from a shell.