API Payload Tester
Send HTTP requests with custom headers and body, then read the status, timing, headers, and JSON response. Runs in your browser.
Request
Headers
This tool runs in your browser, so requests are subject to CORS. The target server must send an Access-Control-Allow-Origin header that includes this origin. If a request fails with a network error, it is almost always CORS, not a problem with your request.
What it does
All the common methods
GET, POST, PUT, PATCH, DELETE, HEAD, and OPTIONS. The body editor hides for GET and HEAD.
Custom headers
Add any header, toggle it on or off without deleting it, and the Content-Type is set automatically when you send a JSON body.
Timing and size
See how long the request took in milliseconds and how big the response was in bytes.
Pretty printed JSON
JSON responses are detected and pretty printed automatically. Copy the whole body with one click.
Header inspection
Read every header the server returned, including CORS and caching headers, on a separate tab.
Runs in your browser
Requests go straight from your browser to the target API. Nothing passes through a ToolDeck server.
How it works
Step 1
Set the request
Pick a method, paste the URL, and add headers or a body if the API needs them.
Step 2
Send
The request fires from your browser. Watch the status, timing, and headers come back.
Step 3
Inspect the response
Read the body as pretty printed JSON, copy it, or switch to the headers tab to check CORS and caching.
How it compares
| What matters | Typical tools | ToolDeck |
|---|---|---|
| Works offline | No | No, needs network to reach your API |
| Sign-up required | Usually | No |
| Request routed through a proxy | Often, to bypass CORS | Never, it goes direct from your browser |
| Watermark | Common on free plans | Never |
| Daily usage limit | Common | None |
| Cost | Credits or subscription | Free, unlimited |
Related tools
Questions people ask
Why does my request fail with a network error?
Almost always CORS. This tool runs in the browser, so the target server must respond with an Access-Control-Allow-Origin header that allows this origin. If the server does not send it, the browser blocks the response before JavaScript can read it. There is no way around it without a proxy, and this tool does not use one.
Do you send my request through a server?
No. The fetch happens directly from your browser to the URL you typed. There is no ToolDeck proxy, so your headers and body never touch our infrastructure.
Which methods are supported?
GET, POST, PUT, PATCH, DELETE, HEAD, and OPTIONS. The body editor hides automatically for GET and HEAD since those should not carry a body.
Can I test endpoints that require auth?
Yes, as long as the endpoint is CORS friendly. Add an Authorization header with your token or API key. Cookies are sent if the API is on a domain that already set them and the server allows credentials with CORS.
Why are some response headers missing?
Browsers hide certain headers from JavaScript for security. Only headers the server explicitly exposes through Access-Control-Expose-Headers are visible for cross origin requests. Common ones like content-type, cache-control, and any Access-Control-* headers are always available.
Is the request saved anywhere?
No. Nothing is persisted. Refresh the page and the URL, headers, body, and response are gone. If you need to keep a request, copy the fields out or save the response body with Copy body.
Can I send form data or files?
Not in this version. Body is sent as-is, so JSON and plain text work well. Set Content-Type to application/x-www-form-urlencoded and format the body yourself for form posts. File upload is not built yet.
What is the best endpoint to test against?
httpbin.org is CORS friendly and echoes back everything you send. Use the sample buttons to load a GET, POST, or PUT against it to verify the tool is working before testing your own API.