API debugging
Send HTTP requests · inspect body / status / headers / timing · import and export curl both ways · generate Python / JS / Go code
请求
Authorization / Content-Type 等常用头都可以加；由服务器生成的头（Host / Content-Length 等）填了也不生效。
GET / HEAD 不带请求体；请求体 ≤ 2MB。
服务端转发：超时 10 秒、单 IP 30 次/小时、300 次/日；不自动跟随重定向（3xx 原样返回）。仅支持公网地址。
响应
本次会话的请求
还没有请求记录。记录只存在当前页面内存里，刷新即清空，不会存到浏览器本地。
导出为代码
把上面「请求」区填好的方法 / 地址 / 请求头 / Body 一键生成对应语言的调用代码，纯本地生成。
HTTP 状态码速查
收到响应码点一下即按 2xx 绿 / 3xx 黄 / 4xx 5xx 红着色；也可在上方搜索框直接过滤。
为什么请求要经服务器转发
浏览器有跨域（CORS）限制。页面里的 fetch 想直接请求第三方接口，对方服务器必须在响应头里明确允许你的站点，否则浏览器会直接拦截——绝大多数接口没有给"任意站点"开这个口子，所以在网页里直连调接口基本都会失败。本工具把你的请求参数交给本站服务器，由服务器以它自己的身份把请求发出去，再把原样的响应（状态码、响应头、响应体、耗时）送回页面展示。
转发有严格的边界。出于安全考虑（防止本工具被当作扫描内网的跳板），服务器只转发到公网地址：本机、内网（10.x / 172.16.x / 192.168.x 等）、保留地址一律拒绝。请求参数仅用于这一次转发，不写数据库、不落盘、不进日志（日志只记目标域名与状态码，不记完整 URL 和正文）；响应内容只返回给你的浏览器，不会转给任何第三方。
调试口径。响应不自动跟随重定向——调试的价值就是看到原始状态码与 Location，3xx 会原样展示，你手动把地址改成目标地址再发即可。请求有 10 秒超时、2MB 请求体上限与 5MB 响应展示上限（超出截断），每个 IP 每小时 30 次、每日 300 次。
FAQ
The browser fetch is bound by cross-origin policy (CORS): if the target API does not allow your origin, the browser blocks the request outright, and most third-party APIs do not open it up. So this page hands the request parameters to the server to send on your behalf, then shows you the response as-is.
No. The parameters serve only this one forward - not written to any database, not persisted to disk; the server log records only the target domain and the status code, not the full URL, headers or body. The response goes only back to your browser for display - nothing is passed to any third party.
No. To stop the tool being abused for internal-network scanning, the server forwards only to public addresses; loopback and private ranges (127.x, 10.x, 172.16-31.x, 192.168.x and so on) are all refused. For intranet debugging use local tools like curl or Postman on your own machine.
30 requests per hour and 300 per day per IP; a 10-second timeout per request; request body up to 2MB; responses displayed up to 5MB - longer ones are truncated and clearly marked; 3xx redirects are not followed automatically.
The value of a debugging tool is seeing the raw status code and the Location header, so 3xx is shown as returned and not followed. To see where it leads, copy the Location address back into the request field and send again.
Click import-from-curl in the request area, paste the whole curl command (multi-line \ continuations, single and double quotes, -X / -H / -d and variants like --data-raw, -u converted to Basic auth are all supported), then click parse-and-fill to set method, URL, headers and body in one go. Parsing runs locally in your browser.
Yes. Once the request fields are filled, the export-as-code block below generates calls in Python (requests), JavaScript (fetch) and Go (net/http) for one-click copying. Generation runs locally, nothing passes through the server.
Use the HTTP status-code quick reference at the bottom of the page: filter by code, English or Chinese name (429, rate limit, 418 and so on); every entry explains in one line what it usually means and where to look next.