Are my API tokens stored?

No. Headers, auth and bodies are forwarded once and discarded — never logged, never written to disk. Only the method, URL, status and timing go into history, and that stays in your browser's local storage. For a production credential you would rather not hand to a third party, use curl.

Can I call an API running on localhost?

No. Requests are made from an R3X server, which cannot reach your machine, and requests to private or loopback addresses are refused on purpose. Use curl locally, or expose the service through a tunnel with a public hostname.

API Request Testerserver-backed

Build a request, send it, and inspect the status, headers and body that come back.

Request

Merged into the URL before the request is sent.

Response

Send a request to see the response.

Status, timing and size appear here, with JSON formatted automatically.

Runs on R3X infrastructure. Requests are sent from an R3X server, because a browser cannot read a cross-origin API response. Headers, tokens and bodies pass through and are never logged or stored. Only the method, URL, status and timing are kept, in this browser's local storage.

Reference

Why the request goes through R3X

A browser cannot read the response to a cross-origin request unless the target sends CORS headers allowing it, and almost no API does. Sending from the browser would therefore work for a handful of endpoints and fail confusingly for the rest. The request is forwarded by an R3X server instead, which also means the target sees a server address rather than yours.

The consequence is worth being explicit about: your headers, tokens and body pass through R3X infrastructure. They are forwarded and discarded — never written to a log, never stored — but they do leave your machine. For a production credential you would rather not hand to a third party, use curl.

What is remembered

Kept	Where
Method, URL, status, timing	This browser's local storage, last 25 requests. Cleared with the button, or by clearing site data.
Headers, auth, body	Nowhere. They live in the page while the tab is open and are gone when it closes.
Response body	Nowhere. It is streamed back to you and dropped.

Limits

Requests time out after 10 seconds. Responses are read up to 2 MB and then cut off, with the panel saying so. Request bodies are capped at 256 KB. Redirects are followed up to five hops, and an Authorization header is dropped if a redirect crosses to another origin — the same rule a browser applies, and the reason an open redirect cannot be used to lift your token.

Only ports 80, 443, 8080 and 8443 are reachable, and only public addresses. An API on your laptop is not reachable from R3X; run curl locally for that.

Keyboard

Key	Action
⌘ / Ctrl + Enter	Send the request from anywhere on the page.
Tab	Indents inside the body editor. Press Escape first to move focus out of it.

Questions

Why does the request go through an R3X server?: Because a browser cannot read a cross-origin response unless the target sends CORS headers allowing it, and almost no API does. Sending from the tab would work for a handful of endpoints and fail confusingly for the rest.
Are my API tokens stored?: No. Headers, auth and bodies are forwarded once and discarded — never logged, never written to disk. Only the method, URL, status and timing go into history, and that stays in your browser's local storage. For a production credential you would rather not hand to a third party, use curl.
Can I call an API running on localhost?: No. Requests are made from an R3X server, which cannot reach your machine, and requests to private or loopback addresses are refused on purpose. Use curl locally, or expose the service through a tunnel with a public hostname.