API Request Tester & Code Generator — Free Postman Alternative

Open the tool in your browser, paste your API endpoint URL, select the HTTP method (GET, POST, PUT, etc.), add headers or body in the tabs below the URL bar, and click Send. The response appears instantly — status code, response time, body, and headers — with no install, no account, and no setup. Works on any device including Chromebooks and restricted work machines where installing desktop apps is blocked.

Click the "+ Save" button in the Collections panel on the left sidebar to name your request and assign it to a collection. Collections and request history are stored in your browser's IndexedDB — no account needed. To sync across devices, click the GitHub icon in the toolbar, paste a GitHub Personal Access Token with gist scope, and click Sync Now. The tool creates a private Gist and syncs automatically whenever you add or delete requests. Open the same tool on another device, enter the same token, and your collections and history appear instantly.

GitHub Gist sync backs up your collections and request history to a private secret Gist on your GitHub account. To set it up: create a Personal Access Token at github.com/settings/tokens with the gist scope, paste it in the GitHub sync panel (GitHub icon in the toolbar), and click Sync Now. On first sync the tool either finds an existing backup Gist or creates a new one. Auto-sync triggers 5 seconds after any add or delete. Deletions propagate — if you delete a collection on one browser, it disappears on all others after sync. History clears propagate the same way.

Open the Auth tab in the request section. For Bearer token authentication, select Bearer Token and paste your JWT or token — it is added as Authorization: Bearer automatically. For API key authentication, select API Key, enter the header name (e.g. X-API-Key) and value, and choose whether it goes in a header or query parameter. For Basic Auth, select Basic Auth and enter username and password — they are base64-encoded automatically. All auth details are included in the generated code for every language.

CORS errors happen when the API server does not include the Access-Control-Allow-Origin header, so the browser blocks the request. When this happens the tool shows a Retry with CORS Proxy button — click it to re-route the request through corsproxy.io, which adds the missing header so the response reaches your browser. Do not use the proxy with sensitive credentials. For production code, the real fix is to configure CORS headers on your API server. Note: cURL, Python, PHP, Ruby, Go, and C# generated code runs server-side and is never affected by CORS.

Reconstruct the request in the tool: paste the URL, set the method, add -H headers in the Headers tab, add the -d body in the Body tab (select JSON for a JSON body), set up auth in the Auth tab. Then switch to the Code tab and select Python, Fetch, Axios, Go, Ruby, PHP, C#, or any other language to get the equivalent code. All 12 languages are available simultaneously — no manual translation needed.

In the Body tab, select GraphQL. Two fields appear: a Query editor for your GraphQL query and a Variables field for a JSON variables object. Enter your query (e.g. { user(id: "1") { name email } }) and variables, then click Send. The tool posts the standard {"query":"...","variables":{...}} JSON to your endpoint. Switch to any language tab in the Code section to get the implementation in Fetch, Axios, Python, Go, and more.

Yes. Select POST from the method dropdown, enter your URL, open the Body tab, choose JSON, and type your payload. Code for all 12 languages generates instantly — JavaScript fetch with JSON.stringify(), Axios with the data field, Python requests with json={}, PHP curl_setopt with json_encode(), Go with bytes.Buffer, C# with StringContent. All generated code sets Content-Type: application/json automatically. Click Send to test the POST live before writing any code.

Open the Env tab and create two environments — dev and prod — using the + button. In each, add a BASE_URL variable with the respective value (e.g. https://dev-api.example.com and https://api.example.com). Use {{BASE_URL}} in your URL bar. Switch environments by clicking the tab name — every {{VAR}} in your URL, headers, and body substitutes automatically before code is generated or a request is sent.

Use environment variables in the Env tab. Add a variable named API_KEY with your actual key value, then use {{API_KEY}} in your Auth field or URL. The generated code contains the {{API_KEY}} placeholder rather than the real value — replace it with process.env.API_KEY (Node.js), os.environ["API_KEY"] (Python), or your framework equivalent before committing. This prevents accidental exposure when sharing code or filing bug reports.

After receiving a response, click Pin in the response action bar to save it as a baseline. Then change your request (different params, different environment, after a deploy) and click Send. Click Diff to open a side-by-side modal showing pinned and current responses — status codes, response times, sizes, and full bodies. Useful for confirming a deploy did not change the response shape.

After receiving a JSON response, use the JSONPath filter input above the response body. Type a path like $.data.users[0].name or $.items[*] to extract a specific value or array. The result updates live as you type. Use $.key for an object key, $.arr[0] for the first element, $.arr[*] for all items. Clear the filter to return to the full response.

Click the Import button in the toolbar and select your exported .json file. The tool reads it locally — nothing is uploaded. For Postman, export as Collection v2.1. For Insomnia, export as v4 format. If the file has one request it loads immediately; for collections with multiple requests, a picker modal appears. All fields populate automatically: method, URL, headers, body, auth, and GraphQL query. Switch to any language tab to get the code.

Configure your request in the tool, then switch to the Code tab and select Jest (JavaScript) or Pytest (Python). The generated code is a complete test file with two test cases: one asserting a 200 status and a defined response body, and one testing 401/403 handling with an invalid token. Both are pre-filled with your actual URL, headers, and body. Copy the file into your test suite and add specific assertions based on the response shape you see in the Response panel.

Click the Share button in the toolbar. The tool encodes your entire request — method, URL, query params, headers, body, and auth settings — as a base64 string in the URL and copies the link to your clipboard. Anyone who opens the link has the full request pre-loaded. Useful for bug reports with a reproducible request, debugging with colleagues, or bookmarking endpoints you use frequently. Auth tokens are included in the link so only share with trusted recipients.

No — avoid storing real production API keys or tokens in collections that sync to Gist. GitHub "private" Gists are not encrypted — they are unlisted links. Anyone who has your Gist URL or Gist ID can read all your saved collections without needing a GitHub login. Never share your Gist URL, Gist ID, or Personal Access Token with anyone. Use environment variables with placeholder names ({{API_KEY}}) in saved requests and substitute real values locally. For maximum privacy, skip Gist sync and use the Export workspace option to transfer collections manually.