Build, send, and inspect HTTP requests with a clean REST client: proxy mode works everywhere, direct mode runs fully in your browser.
Requests can travel two ways. Proxy mode (the default) relays the request through the Kit Utility server, so it works even when the target API sends no CORS headers; it requires an https:// URL and caps responses at 1 MB. Direct mode sends the request straight from your browser with no server in the middle, welcomes localhost and private network URLs, and the browser enforces CORS on responses (explained below).
Direct mode sends the request straight from your browser to the URL you enter. The target must allow CORS and may still be blocked by the site's security policy. Localhost and private network URLs work only in this mode.
Common pair: Content-Type and application/json for JSON bodies. In direct mode the browser blocks a few protected headers such as User-Agent, Cookie, and Origin. In proxy mode the relay drops hop-by-hop headers (Host, Connection, Content-Length, Transfer-Encoding) and passes the rest through.
Network request blocked
The browser could not complete the request. This is almost always CORS: the target server must allow browser requests (CORS); APIs with a permissive Access-Control-Allow-Origin header work, others will block. That is browser security, not a bug. Strict APIs can still be called from a server, from curl, or from a desktop client. Also note that an HTTPS page cannot call a plain HTTP endpoint (localhost is the one exception most browsers allow).
Response headers
Response body
This is a lightweight REST client for everyday development work: pick a method, enter a URL, add the headers your API expects, paste a JSON body, and send. The response panel shows the status code, status text, elapsed time, every header the browser exposes, and the body (pretty-printed with syntax dimming whenever it parses as JSON). Your last ten requests are kept in per-tab history with one-click reload, so iterating on an endpoint does not mean retyping it.
Direct mode sends requests straight from your browser to the target URL, and the rules that govern browsers apply to you. The most important one is CORS: the target server must allow browser requests (CORS); APIs with a permissive Access-Control-Allow-Origin header work, others will block. That is browser security, not a bug. Proxy mode sidesteps it by relaying through the Kit Utility server (https URLs only, responses capped at 1 MB), and neither mode logs or stores your request contents. Public APIs that document browser access, and local development servers with CORS enabled, are the sweet spot for this tool.
Because direct mode has no server hop, localhost is a first-class target: point it at your own development server on any port. Combine it with the JSON Formatter for inspecting large payloads, or the JWT Debugger when a protected endpoint returns a token you need to decode.
The request never reached the server, or the server did not send CORS headers the browser accepts. The target server must allow browser requests (CORS); APIs with a permissive Access-Control-Allow-Origin header work, others will block. That is browser security, not a bug. Call strict APIs from a server, curl, or a desktop client instead.
Only in proxy mode. Proxy mode relays the request through the Kit Utility server so APIs that send no CORS headers still work; it requires an https:// URL and caps responses at 1 MB. Direct mode sends every request straight from your browser with no server hop. Neither mode logs or stores your requests, headers, or bodies.
Yes, in direct mode. This is a development tool, so direct mode allows any URL, including http://localhost on any port and private network addresses. Browsers treat localhost as a secure context exception, so an HTTPS page can still call a local development server over plain HTTP. Proxy mode is https only and blocks local and private network targets.
In direct mode, browsers maintain a forbidden header list that scripts cannot override, including User-Agent, Cookie, Origin, Host, and Content-Length. Setting them has no effect. In proxy mode the relay passes custom headers such as Authorization or X-Api-Key through and only drops hop-by-hop headers (Host, Connection, Content-Length, Transfer-Encoding).
In sessionStorage, scoped to the current browser tab and erased when the tab closes. Only the last ten requests are kept (method, URL, headers, body, and the response status with timing), and the Clear history button wipes them immediately.