API Header Builder

Runs in browser Web

Assemble Authorization (Bearer, Basic, API key), Accept, Content-Type, correlation and custom headers with validation, then copy them in the syntax your client needs.

Privacy: This tool runs entirely in your browser. Your input never leaves your device.

How to use API Header Builder

  1. Choose the authentication type and enter the credential.
  2. Pick Accept / Content-Type values and toggle tracing or idempotency headers.
  3. Add any custom headers your API requires.
  4. Select the export format, copy the block into your client, and click Regenerate for new correlation IDs.

API Header Builder features

  • Authorization presets: Bearer, Basic (auto base64) and API key headers
  • Accept, Content-Type and Accept-Language pickers with correct charset parameters
  • One-click tracing headers: X-Request-Id (UUID v4) and W3C traceparent, plus Idempotency-Key and Cache-Control: no-cache
  • Custom headers with RFC-compliant name validation
  • Export as raw headers, cURL, fetch, axios, a full HTTP request or a JSON object
  • Secrets masked in the reference table, never sent anywhere

API Header Builder example

Bearer + JSON + tracing as fetch

Input:

Auth: Bearer eyJ… · Accept: application/json · Content-Type: application/json · Tracing: on · Export: JavaScript fetch

Output:

fetch("https://api.example.com/v1/orders", {
  method: "POST",
  headers: {
    "Authorization": "Bearer eyJ…",
    "Accept": "application/json",
    "Content-Type": "application/json",
    "X-Request-Id": "8f1c…",
    "traceparent": "00-4bf9…-00f0…-01"
  },
});

Frequently asked questions about API Header Builder

How is Basic authentication encoded?

The tool base64-encodes "username:password" and emits Authorization: Basic <encoded>. Because base64 is not encryption, only use it over HTTPS.

What are X-Request-Id and traceparent for?

X-Request-Id is a correlation ID you can search for in server logs. traceparent is the W3C Trace Context header (version-traceId-spanId-flags) that tracing systems such as OpenTelemetry, Datadog and Jaeger understand. Click Regenerate for fresh IDs.

When should I send an Idempotency-Key?

On POST requests that create something (payments, orders). If the client retries after a timeout, the server recognises the key and does not create a duplicate. Stripe, Adyen and many payment APIs require it.

Are my tokens stored or sent anywhere?

No. Everything is assembled in your browser. Sensitive fields are masked in the reference table; the export contains the real value so you can paste it into your client.