Test API endpoints with bearer tokens. Send authenticated requests and inspect response headers and status codes.
Enter a URL and an access token, and this tool performs an HTTP request from your browser to that endpoint while adding an Authorization header in the Bearer scheme. It returns the response status, headers, and body so you can verify how the API treats your token. The most common surprise is that the request is subject to CORS: if the target API does not allow your current origin, the browser blocks you from reading the response, even though the server may have received the request. The tool cannot bypass CORS or fix misconfigured servers.
A concrete input and expected output from the current implementation.
Input
URL: https://api.example.com/v1/user/info Token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
Expected output
Status: 200 OK
Headers:
content-type: application/json
cache-control: no-store
body: {"user":{"id":"1234567890","name":"John Doe"}} A valid token for that endpoint passes authorization, so the server returns a 200 status with the requested resource. The exact body and headers may vary by endpoint, but the output format will always list the status, headers, and body.
The tool takes the token you enter and constructs an Authorization header in the format 'Bearer <token>'. The header value is sent with every request to the URL you provide. It is not stored or transmitted anywhere except to the target server as part of the normal HTTP request.
The tool uses the browser's fetch API to send the request. After the server responds, it shows you the status code, response headers, and response body. Because the request is made from your browser, the browser's same-origin policy applies: if the target API does not include your origin in its CORS allowlist, you will get a CORS error and cannot see the response, even if the server handled the request.
The browser blocks your ability to read the response unless the API sends an appropriate Access-Control-Allow-Origin header that includes your current origin. Your server may still receive and process the request. You need to configure CORS on the API, or use a different tool that does not enforce browser same-origin policy.
Yes, you can send it, but the API will likely return a 401 Unauthorized status. That response is useful for confirming that the API rejects inactive tokens. The tool will show you the exact status and body so you can see how the API communicates an invalid token.
The example and behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.
Generate strong, random passwords with customizable length, character sets, and complexity requirements.
Analyze password strength with entropy scoring, crack-time estimates, and improvement suggestions.
Create cryptographically random strings for API keys, tokens, salts, and unique identifiers.
Create QR codes for URLs, text, Wi-Fi credentials, vCards, and more with customizable size and colors.
Scan and decode QR codes from uploaded images or your device camera to extract embedded data.
Compute MD5, SHA-1, SHA-256, and SHA-512 checksums to verify file integrity and detect tampering.