All tools

CORS tester

See whether an API lets a web page read it, whether a preflight is sent and why, and which headers it would need. Free, with no account or uploads.

Test an API's CORS

Send a request from this page, as any web page would. If the API does not allow it, the client says why: CORS, a preflight that failed, or a server that cannot be reached, and which headers would let it through.

Try one

Requests go straight from your browser to the API: nothing passes through KeepSimp. So, as for any web page, the API must let other sites read its answers (CORS); when it does not, the client says why and what it would have to send.

How it works and help

A little help along the way

Follow these steps. Every option is explained underneath. Requests go straight from your browser to the API, never through KeepSimp.

  1. Type the addressType the API's address, such as api.example.com/v1/items, and press Send. On the client's own page, Try an example API offers ready requests, and Bring in requests opens a Postman, Insomnia, OpenAPI or HAR file. A name on your computer or network, such as localhost:3000, is sent over http, anything else over https.
  2. Or paste a cURL commandPaste a cURL command into the address, such as one copied from your browser's developer tools, and it becomes the request. Anything a browser cannot do, such as a proxy or a client certificate, is named in a note.
  3. Choose the methodType or pick GET, POST, PUT, PATCH, DELETE, HEAD or OPTIONS, or a method of your own. GET and HEAD cannot carry a body in a browser.
  4. Add the query and headersUnder Query, each row is written into the address as typed; switch a row off to keep it without sending it. Under Headers, add a name and a value; a header the browser sets itself, such as Cookie, is marked and not sent. Edit as text takes many rows at once.
  5. Write the bodyUnder Body, choose JSON, text, XML or HTML and type it, with Tidy it to lay it out; or form fields, multipart parts with files, or one whole file. Its Content-Type is sent for you unless a header row says another.
  6. Sign inUnder Auth, choose a user and password (Basic), a bearer token or an API key, sent as a header or in the query.
  7. Send it and read the answerPress Send. The answer shows its status in words, its time and size, then its body (tidied, as it came, or previewed), its headers, its timing and exactly what was sent. Copy the body or save it as a file.
  8. When it is blockedWhen the browser keeps an answer from the page, the client says why: the API does not allow this site (CORS), it could not be reached, an http address was sent from this https page, or the time ran out. For CORS it lists the headers the API would have to send.
  9. Keep requests in collectionsPress Save (Ctrl or ⌘ + S) to put the request in a collection or a folder. Collections and History are on the left (on a phone, under the panel button): open a saved request in a tab of its own, rename, copy, move or delete it from its menu, and open a request you sent before.
  10. Use variables and environmentsWrite {{name}} anywhere in a request. Under Environments, make one for each place you send to, such as Local and Live, with its variables, and choose it at the top; a collection has variables of its own, and the globals hold for all. Typing {{ offers the names. Mark a token as a secret and its value is never kept.
  11. Open Postman, Insomnia and OpenAPI filesUnder Open, choose or paste a Postman collection or environment, an Insomnia export, an OpenAPI or Swagger description in JSON or YAML, a HAR file or a cURL command. A collection's menu saves it as a Postman collection or a KeepSimp file.
  12. Sign in with OAuth, AWS or a JWTUnder Auth, OAuth 2.0 gets a token by signing in at the provider (with PKCE), with client credentials or with a user and password; add the callback address shown to your app. AWS Signature signs the request on this device; JWT made here signs a token with your secret or private key each time. A request can take its folder's or collection's sign-in.
  13. Check the answer, and chain requestsUnder Checks, add rows such as Status equals 200 or JSON at $.items[0].id exists; they run after every answer. Under Take values into variables, take $.access_token into token, and the next request can send {{token}}. The answer's Tests tab shows what passed.
  14. Write scriptsUnder Scripts, write JavaScript to run before sending (set variables, add headers) and after the answer (pm.test, pm.expect, keep values), with Postman's pm. Snippets start you off. Scripts run sealed off from this site and the network.
  15. Run a collectionFrom the window's menu or a collection's menu, Run a collection sends its requests in order with their scripts and checks, once or once for each row of a CSV or JSON data file, and saves a report as JSON or JUnit XML.
  16. GraphQLChoose GraphQL beside the method, type the API's address, and press Ask for the schema: fields are then offered as you type the query, it is checked, and Docs lists every type. Put variables in as JSON, and choose which operation to run when the query has several.
  17. WebSockets and event streamsChoose WebSocket beside the method to connect to a ws:// or wss:// address with subprotocols, send text or JSON, and read every message in the log. An answer that is an event stream (text/event-stream) shows its events as they arrive; Stop closes it.
  18. Get the request as codeCopy as, Other languages (Alt or ⌥ + K) writes the request in cURL, Wget, HTTPie, PowerShell, JavaScript, Node, axios, Python, Go, Rust, Java, C#, PHP, Ruby, Swift, Kotlin or Dart, with its variables filled in.
  19. KeysCtrl or ⌘ + Enter sends, Ctrl or ⌘ + . stops, Ctrl or ⌘ + S saves, Ctrl or ⌘ + L goes to the address, Alt or ⌥ + T opens a tab and Alt or ⌥ + W closes it, Alt or ⌥ + B shows collections and history, Alt or ⌥ + E edits environments, Alt or ⌥ + 1 to 8 go to the query, headers, body, sign-in, settings, answer, checks and scripts, Alt or ⌥ + K shows the request as code, Alt or ⌥ + R runs a collection, Alt or ⌥ + C copies the request as cURL, and Ctrl or ⌘ + / lists the keys.

Questions people ask

Does this test my own site's CORS?
It tests whether a page on keepsimp.com may read an API. An API that allows every site (*) allows yours too. For one that names sites, the client shows what was sent and which headers the API would need, which you can then check for your own origin.
What is a preflight?
Before a request that is not simple (a method other than GET, HEAD or POST, a header beyond a few plain ones, or a body that is not form data or text), the browser asks the server with an OPTIONS request. The line under the address says whether this request needs one, and why.
How does it know the failure was CORS?
A browser tells a page only that a request failed. The client then sends one HEAD request that needs no leave: if the server answered that, the server is there and the failure was CORS.

This page is the API client, opened for this one job; every other tool it has is one press away. Each of its settings is explained on the API client's own page.

Read the step-by-step guide

Guides

Same tool, other jobs

Tools nearby