Call any external API from your browser without CORS errors. All HTTP methods, custom headers, request bodies. 50 requests/day free.
Any API that blocks browser requests due to missing CORS headers can be reached through the ToolBit proxy server-side.
GET, POST, PUT, PATCH, DELETE - with a custom request body for POST/PUT and full control over HTTP method.
Pass Authorization, API keys, Accept, Content-Type, or any header your target API requires.
Save your API requests into named collections for reuse. Organize by project, client, or environment (Pro+).
See the response status, headers, and body formatted directly in the dashboard. No separate API client needed.
Internal network addresses are blocked. The proxy only forwards to public internet URLs - no access to your infrastructure.
Log in to your ToolBit dashboard and navigate to the API Proxy tab in the sidebar.
Paste the target API URL, select your HTTP method, and optionally add headers and a request body.
ToolBit makes the request server-side and returns the full response - status code, headers, and body - to your browser.
Save frequently used requests to a named collection so you can re-run them with one click without re-entering the details.
CORS (Cross-Origin Resource Sharing) is a browser security policy that blocks requests from one domain (e.g. your website) to another domain (e.g. an external API) unless the API server explicitly allows it. Many APIs - especially third-party services - do not set the right CORS headers, so browsers refuse to complete the request. A proxy solves this by making the request server-side, where CORS does not apply.
ToolBit does not log request headers or bodies. Your API keys are forwarded to the target and not stored. That said, for production applications with sensitive credentials, making requests from your own backend is always safer than routing through a third-party proxy.
Free: 50 requests/day. Starter: 200 requests/day. Pro and Elite: unlimited. Limits reset at midnight UTC.
Any publicly accessible HTTPS or HTTP URL. Internal/private addresses (localhost, 10.x, 192.168.x, etc.) are blocked by SSRF protection.
Collections let you save named API requests - URL, method, headers, body - and re-run them without re-entering the details. Available on Pro and Elite plans. Think of it as a lightweight Postman or Insomnia built into ToolBit.
Currently the proxy is UI-only. Programmatic access via ToolBit's own API is on the roadmap for Pro accounts.
50 free proxy requests per day. No credit card required.
Try the API Proxy Free →Comparing options? See how ToolBit compares to CORS Anywhere and AllOrigins →