HTTP & REST Client

Construct, test, and debug HTTP requests with custom headers, body payloads, and token authorization.

Privacy: Client-Direct + Server-Proxy. Prefer browser fetch() to the IdP. On CORS failure or confidential clients, fall back to /api/v1/proxy/token. Credentials and assertions are not retained.

Proxy uses /api/v1/proxy/http. Localhost/private IPs blocked.

OnKeyValue

Response

Send a request to inspect the response.

What is an in-browser REST client?

A REST client lets you craft HTTP methods, headers, and bodies against APIs without installing a desktop app. In the browser, CORS policies often block cross-origin calls — Utilxo tries a native fetch first, then can route through a lightweight proxy when needed.

Auth mirrors Postman: paste a pre-minted Bearer token, Basic or API key, or fetch a token via OAuth 2.0 client_credentials with client_secret_basic, client_secret_post, client_secret_jwt, or private_key_jwt. You can also import tokens from the OAuth playground or JWT workbench.

How to use this tool

  1. Enter a URL, pick a method, and add query params or headers (toggle rows on/off).
  2. Configure Auth — Bearer (pre-minted), Basic, API key, or OAuth Client Credentials (Get New Access Token) — plus optional body (JSON, form, raw, XML).
  3. Send the request, inspect status/timing/size, pretty JSON, and response headers. Reopen past calls from History.

Frequently asked questions

When should I use the proxy?

Use Auto or Force proxy when the API omits Access-Control-Allow-Origin. Localhost and private IPs are blocked on the default Utilxo proxy for safety. For a corp or local relay, open header Settings → Proxy (BYOP) and set a custom proxy URL once for all hybrid tools.

How does OAuth Client Credentials work here?

Choose Auth → OAuth 2.0 Client Credentials, set the token URL and client ID, pick client auth (secret basic/post/JWT or private_key_jwt), then Get New Access Token. The returned token is applied as Bearer on the next Send. Token fetch uses the same proxy mode as the request bar.

Is request history uploaded?

History is stored in localStorage on your machine only.