Cross-Origin API Request Builder
Build and send real GET/POST/PUT/DELETE requests from your browser to debug APIs and CORS.
Private by design. Every tool runs 100% in your browser — your code, text, and tokens never leave your device. Nothing is uploaded or stored.
Request Builder
This runs entirely in your browser. Cross-origin calls only succeed when the target server returns
Access-Control-Allow-Origin. For endpoints you do not control, run the request from your own backend or a proxy — a static site cannot bypass CORS for you.Response headers and body appear here.
Frequently Asked Questions
Is it safe to send requests from my browser?
Yes — requests originate from your own browser and are not stored. Note that CORS may still block cross-origin calls unless the target API allows your origin.
Which method should I use to test a write?
Use POST/PUT/DELETE against a staging endpoint, never production, unless you intend the side effect. The builder shows the exact payload and headers before you send.
Why is my Authorization header stripped?
Some browsers hide Authorization in certain CORS scenarios; the server must allow it via Access-Control-Allow-Headers. The CORS Header Generator can produce the right config.