REST / API client
Build a request, fetch it from this tab, inspect the response. Subject to CORS.
Runs in this tab. The file stays here.
This runs in your browser. Nothing is uploaded to ihateonlinetools.com.
About REST / API client
Browser REST client for method, URL, headers, and body with a response viewer. Calls are subject to the target API’s CORS policy; history stays in localStorage.
Sometimes you need to poke an API without opening Postman. This client builds a fetch request from method, URL, headers, and body, then shows status, response headers, and a pretty-printed body when JSON parses. Recent requests can sit in localStorage on this device.
CORS is the hard limit. If the API does not allow your origin, the browser blocks the response. That is the same constraint every in-browser REST client hits, including Hoppscotch on the web. It is not a bug in this page. Use a desktop client or a server-side proxy when you must bypass CORS—and know that a proxy is a different trust model.
Do not paste production secrets into a shared screen recording. History is local; clearing site data clears it.
Edge cases include preflight OPTIONS failures on custom headers, cookie-authenticated APIs that refuse cross-origin reads, mixed-content blocks when this site is HTTPS and your URL is HTTP, and streaming or binary responses that do not pretty-print as JSON. Large response bodies can freeze the panel while they stringify. OAuth redirects and WebSockets are out of scope.
Requests go from your browser directly to the URL you type. ihateonlinetools.com does not proxy them, log them, or store them on my server. History in localStorage is the only persistence, and it stays on this device. Network traffic is visible to the API operator and anyone on your network path, same as curl from your laptop. Treat bearer tokens like passwords.
How to use REST / API client
- 1Enter method and URL; add headers and body as needed.
- 2Send the request and inspect status, headers, and body.
- 3Re-open a recent call from history if you saved one locally.
What it won't do
- Subject to CORS.
- No cookie jar UI for third-party sessions beyond what the browser already sends.
- No server-side proxy; requests originate from your browser only.
Common questions
Why did my request fail with a CORS error?
The target server did not allow this origin to read the response. Fix CORS on the API, or use a non-browser client.
Are requests proxied through ihateonlinetools.com?
No. fetch runs from your browser straight to the URL you typed.
Where is request history stored?
In localStorage on this browser only, never on my server.
Why do some APIs work in curl but fail here?
curl is not bound by browser CORS. The API must send Access-Control-Allow-Origin (or you must use a non-browser client) for this page to read the response.
Related tools
Why this one doesn't upload your file
There is no server to upload to. This page is a static file, and the work happens in your browser using the same graphics and WebAssembly code that renders every other site you visit. Your file is read from disk into memory, processed, and handed back as a download. Once the page has loaded you can disconnect from the network entirely and it keeps working. The longer explanation