DarnlyAPI tester: send a request, see what went wrong
Test any API endpoint in your browser, with no install and no CORS errors. The status comes back in plain words, with what to do when it fails.
Free from Darnly. Spot a bug in the app you're building? Darnly hands it to Claude Code, Codex or Cursor in one key.Add to Chrome
Sending the example…
🔒 Requests go through darnly.dev’s server, so there are no CORS errors. Nothing is stored or logged, and your cookies are never sent.
Response headers
What was sent
Secrets are hidden here. The real values were sent.
More free tools
See all 89 tools- JSON to TypeScriptPaste JSON and get TypeScript types and a Zod schema, with optional fields found for you.
- Diff checkerCompare two texts side by side and see every added, removed and changed word. Nothing is uploaded.
- px to rem converterpx to rem and back, live, with the matching Tailwind class and a ruler at real size.
How it works
- Pick the method (GET, POST…) and paste the API address. You can also paste a whole
curlcommand into the address box and the form fills itself in. - Add headers, a JSON body (it’s checked as you type) or a token in the Auth tab, then press Send.
- The big card shows the status in plain words, with what to do when it fails, plus the time, size and whether browser apps can call it. Copy the request as curl or fetch code, or copy a prompt for your AI agent.
Questions
Is it safe to put my API key here?
Your request goes through darnly.dev’s server so it works without CORS errors. Nothing is stored or logged: not the address, not your token, not the response. Your own cookies are never sent, and a Cookie header is dropped. Still, use a test key when you can, and never paste a production database password into any website.
Why does it work here but fail in my app with a CORS error?
Browsers only let a web page read an API on another domain when that API sends an Access-Control-Allow-Origin header. This tool sends requests from a server, where CORS doesn’t apply, so it shows the CORS card to tell you whether your browser app will be allowed. If it says “Blocked in browsers”, call the API from your backend (a Next.js route handler, a Supabase Edge Function) or add the header on the API.
What does 401 vs 403 mean?
401 means the API doesn’t know who you are: the token is missing, wrong or expired. 403 means it knows who you are, but you aren’t allowed to do that: the key lacks a permission, or (in Supabase) a Row Level Security policy blocks the row.
Can I test my localhost API?
No. The request is sent from our server on the internet, which can’t see your computer. Deploy a preview (Vercel and Netlify make one for every branch), or use curl in your terminal for localhost.
Why is the time different from my app?
The time is measured from our server, which sits in a data center near you. Your users’ phones add their own network time on top. Over a second is slow for an API; over 10 seconds and many hosts stop the request.
What are the limits?
Up to 20 requests a minute, a 10 second timeout, 200 KB for the body you send and 1 MB of response shown. Redirects are followed up to 5 times, and your Authorization header is not passed on to a different domain.