stboxsandbox tools
All tools

HTTP & REST Client

Construct, test, and debug HTTP requests with custom headers, body payloads, and token authorization.

Network & APIs
Privacy: Client-Direct + Server-Proxy. Prefer browser fetch() to the IdP. On CORS failure or confidential clients, fall back to /api/v1/proxy/token. Credentials and assertions are not retained.

Proxy uses /api/v1/proxy/http. Localhost/private IPs blocked.

OnKeyValue

Response

Send a request to inspect the response.

What is an in-browser REST client?

A REST client lets you craft HTTP methods, headers, and bodies against APIs without installing a desktop app. In the browser, CORS policies often block cross-origin calls — stbox tries a native fetch first, then can route through a lightweight proxy when needed.

Auth integrates with other stbox tools: import access tokens from the OAuth playground or JWTs from the JWT workbench into the Bearer field.

How to use this tool

  1. Enter a URL, pick a method, and add query params or headers (toggle rows on/off).
  2. Configure Auth (Bearer, Basic, or API key) and optional body (JSON, form, raw, XML).
  3. Send the request, inspect status/timing/size, pretty JSON, and response headers. Reopen past calls from History.

Frequently asked questions

When should I use the proxy?

Use Auto or Force proxy when the API omits Access-Control-Allow-Origin. Localhost and private IPs are blocked on the proxy for safety.

Is request history uploaded?

History is stored in localStorage on your machine only.