API client (Postman online)
Send GET, POST, PUT, PATCH and DELETE requests from the browser: query parameters, headers, a JSON, form or file body, Bearer, Basic or API-key auth. Shows status, time, size, headers and a formatted body; imports cURL and writes the request as cURL, fetch, axios or Python. Nothing to install, no account.
- In
- HTTP request
- Out
- response
The request goes to corsproxy.io, a third-party service, which sends it to the API and returns the answer. It sees everything in the request — URL, headers, body, tokens and passwords. Use it for public APIs and test data, not for production secrets.
corsproxy.io works only with a key; the free plan has 10,000 requests and 1 GB a month. The key stays in this field and is not saved. localhost and local networks cannot be reached through a proxy on the internet. Cookies are not sent. Get a key: console.corsproxy.io
GET and HEAD requests have no body — switch the method to send one.
Tokens, passwords and keys stay in this tab: they are not saved in the history or the browser and leave only with your request.
Enter a URL and press Send (Ctrl+Enter). The request goes straight from this tab to the API — not through our server.
The browser lets a page read the answer only if the API allows it (CORS). Public APIs and your own localhost usually do; an API that does not will show an error here — then use the Code tab and run the same request as curl.
History
Kept in this browser, without tokens, passwords, keys or cookies.
Related
Questions
Why does a request fail with a CORS error?
A browser lets a page read a response from another site only if that site allows it with Access-Control-Allow-Origin. Postman is a desktop app and is not bound by this; a web page is. Public APIs and local servers usually allow it; for one that does not, take the request from the Code tab and run it as curl.
Do my requests and tokens go through your server?
No. The request goes from this tab straight to the API — unless you turn on corsproxy.io, and then through that service, never through ours. Tokens, passwords and keys are not saved — the history keeps the method, URL, headers and body without them.
Can I call an API on localhost?
Yes, if your server answers with CORS headers (in development most frameworks have a switch for it). Newer Chrome asks once for permission to reach devices on your local network — allow it for this site.
Why are some headers not sent?
Cookie, Host, Origin, Referer, Content-Length and a few others belong to the browser: a page cannot set them, and the form warns when you add one. To send cookies of the API's own site, turn on "Send cookies".
How do I bring a request over from DevTools or the API docs?
In DevTools, right-click a request in the Network tab → Copy → Copy as cURL, then paste it into the URL field or "Import cURL". Method, headers, body and auth are filled in.
Can I get around CORS?
Turn on "Send through corsproxy.io" and paste a key from a free corsproxy.io account: the request goes through that service, which adds the headers the browser needs. It sees the whole request, tokens included, so use it for public APIs and test data. The key is not saved.