API testing tools

Three small utilities that run entirely in the page. No signup, no upload, no request to a server — which for two of them is the point rather than a nicety, because people paste live credentials and signing secrets into tools like these.

They exist because the playground already had the hard parts. It generates request code in nine languages, issues real signed JWTs from its auth endpoints, and signs every webhook delivery with an HMAC you are meant to verify. These take those three capabilities out of the docs pages and make each one usable on its own, against your own input.

• Convert a curl command to code — Paste a curl command, get the same request in nine languages — fetch, axios, Python, Go, C#, RestAssured, Playwright, k6 and HTTPie.
• Decode a JWT and read its claims — Paste a JSON Web Token to read its header and claims, and see whether it has expired. Nothing leaves the page.
• Verify an HMAC webhook signature — Check a webhook signature against the payload and the shared secret, with HMAC-SHA256, SHA-1 or SHA-512. Nothing leaves the page.

API testing glossary · Testing techniques · All 39 mock REST APIs