19 tools

API Tools

API work generates a recurring set of small problems: an unreadable JSON payload, a token whose claims you need to see, a header block copied from curl, a signature that will not verify, and a status code you half-remember. These tools cover all of them, and everything except the live URL checks runs in your browser, so production payloads and tokens stay on your machine.

Debugging an API request means answering four questions in turn: what did I send, what came back, what does the status code mean, and was the authentication right. Each has a different tool, and they are scattered across categories because they are different kinds of work.

This page collects them in the order you actually reach for them. The important practical point is that almost all of it happens locally — a request body or a bearer token is exactly the sort of thing that should not be pasted into a service that uploads it.

Payloads

6 tools

Read, check and reshape the JSON going in and out.

Authentication and signing

4 tools

Inspect tokens and reproduce the signatures a webhook expects.

Requests and responses

6 tools

Take apart the URL and headers, and find out what a live endpoint returns.

Identifiers and encoding

3 tools

Generate the values an API needs and encode them correctly.

What people use these for

Making a minified error response readable so you can find the message.
Checking whether a request body matches the schema an endpoint publishes.
Reading the claims in a bearer token to see why a request returns 401.
Reproducing a webhook signature to work out why delivery is being rejected.
Comparing a working request against a failing one, field by field.
Confirming what headers and status code an endpoint actually returns.

API Tools: frequently asked questions

Is it safe to paste a real API payload or token here?

The JSON tools, the JWT decoder, HMAC signing, the parsers and the encoders all run entirely in your browser and transmit nothing. The two live checks — the HTTP header checker and the redirect checker — send the URL to our server because a browser cannot read cross-origin headers. Never paste a signing key or secret anywhere, here included.

Why is my API returning 401 when the token looks fine?

Most often the token has expired. Decode it and check the exp claim, remembering that JWT timestamps are in seconds, not milliseconds. After that, check the audience and issuer claims match what the API expects — a valid token for the wrong audience is still rejected.

How do I work out why a webhook signature fails?

Reproduce it. Take the exact raw request body, the algorithm the provider specifies and your signing secret, and compute the HMAC. If it differs, the usual causes are a body that was re-serialised before signing, a missing timestamp or prefix in the signed string, or comparing hex against Base64.

What is the difference between 401 and 403?

401 means the request was not authenticated — no credentials, or credentials that were not accepted. 403 means it was authenticated and the identity is not permitted to do this. If you are getting 403, sending better credentials will not help; the permission is the problem.

Should I use JSON Schema to validate requests?

It is worth it for anything with more than a few fields, and it doubles as documentation. Validating against a schema catches the mismatches that otherwise surface as confusing 500s deeper in the stack, and the schema can generate types for the client too.

All tools →

Last reviewed 7 August 2026.