Do my requests or auth tokens pass through sitekits servers?

No. Requests are sent by your browser directly to the URL you enter — sitekits servers are never involved and never see your URLs, headers, or tokens.

Why does my request fail with a network or CORS error?

Because the request comes from your browser, the target server's CORS policy applies. If the API does not allow cross-origin requests from this site, the browser blocks the response and the tool reports "Request failed (network error or CORS blocked by the target server)."

Which HTTP methods can I use?

GET, POST, PUT, PATCH, DELETE, HEAD, and OPTIONS. A request body can be attached to every method except GET and HEAD.

REST API Tester

Overview

A minimal HTTP client for quick API checks — no install, no account. Pick a method, set a URL, add headers and a body, and inspect the raw response. Because everything runs in your browser, it behaves exactly like a fetch call from a web app, CORS rules included.

How to use

Choose a method (GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS), enter the endpoint URL, and press Send.
Add request headers in Headers (one per line: Key: Value), e.g. Authorization: Bearer ….
For non-GET/HEAD methods, fill in Body (JSON, form data, or any raw text).
Read the results: Status, Time in milliseconds, Response headers, and Response body.

Examples

GET https://api.github.com/zen → 200 OK with a short plain-text body
POST https://httpbin.org/post with body {"ping":1} and header Content-Type: application/json → echoed JSON

Notes

Requests go directly from your browser to the target; the target’s CORS policy decides whether the response is readable. Response bodies are displayed up to 100,000 characters. Avoid pasting production credentials you would not put in a browser tab.