Which API testing extension should I use?

It depends on the job. To test the API calls a web app makes while you use it, and have failed, slow and duplicate calls flagged for you, use RequestFox. For a raw look at everything one page load does, the built-in DevTools Network panel needs no install. To build and share API collections across a team, Postman is the usual choice; to keep them as files in git, Bruno; for always-on rules that redirect or rewrite traffic, Requestly.

RequestFox runs in Firefox as a sidebar with the same capture, flags, mocks, checks and exports as in Chrome. Firefox's own Network Monitor is built in and shows every request. In Firefox, pre-request and post-response scripts, and rewriting a request or reply with a script, don't run (Firefox does not let extensions run code typed at runtime; chaining values between requests still works). One small difference: clicking a RequestFox notification opens the sidebar in the window you are looking at, which may not be the one being recorded.

RequestFox is a free browser extension that composes and sends requests with environments, {{variables}}, auth helpers including OAuth 2.0 and saved collections, imports Postman, Insomnia, Bruno, Hoppscotch and Thunder Client collections, and exports Postman collections and collections for Bruno, Insomnia and Hoppscotch. Unlike a standalone client it also records the calls your web app really makes. It has no cloud workspace or team sync.

DevTools shows every request and leaves the judging to you. RequestFox flags failed, slow, duplicate and retried calls as they happen, ties each one to the click that caused it, checks your per-endpoint rules, and keeps every session so you can compare today's run with yesterday's. DevTools is better for a raw, live view of everything a page loads.

Open DevTools (F12), choose Network, and filter by Fetch/XHR. To keep the list while you click through a whole flow and have problems flagged for you, open the RequestFox side panel, press Start, and use the site: every fetch, XMLHttpRequest, WebSocket and server-sent event call is listed the moment it starts.

RequestFox flags them as they happen: every 4xx, 5xx and dropped connection, calls slower than a threshold you set, rapid double-fires and retries. Each flag is tied to the click or form submit that caused it, and failures are explained in plain words. By hand, sort the DevTools Network panel by Status, Time and Name and compare rows.

GraphQL servers often answer 200 OK with an errors array in the body, so the status column looks fine. Check each response body for a non-empty errors key, and treat it as a failure in your client and tests. RequestFox reads GraphQL and JSON-RPC responses and flags these errors automatically, with the server's own message.

Often the access token expired minutes earlier and was never refreshed. The middle part of a JWT is base64url-encoded JSON with an exp time you can compare with the response's Date header. RequestFox decodes the bearer token locally, reading only its times, issuer and audience, and says on the request when an expired token caused the 401 or 403.

Look for one path called again and again with only an id changing, like /products/101/reviews, /products/102/reviews, in a short burst. RequestFox turns paths into templates such as /products/{id}/reviews and flags the burst as N+1. The fix is a batch endpoint or including the data in the list response.

RequestFox remembers the JSON shape each endpoint returned earlier in the session and flags SCHEMA CHANGED when a field is added, removed or changes type, with exactly what differs. For a fixed contract, add a per-endpoint check with a JSON Schema.

In RequestFox, open a captured call and choose Mock: it returns that call's real status, headers and body, which you can edit, for both fetch and XMLHttpRequest. A fault rule can instead make a call fail like a dropped connection, add delay, or pause it so you can edit the request or reply. Mocked responses are labelled in the log.

Yes. After a recording, RequestFox's Performance panel turns the captured endpoints into a runnable k6, JMeter, Gatling or Locust script, with your chosen users, ramp-up and duration, and each endpoint's measured p95 latency as its pass/fail threshold. It can also export end-to-end tests for Playwright or Cypress.

RequestFox exports a recorded session as a HAR file, a Postman collection, an OpenAPI 3.0 spec built from the calls, CSV, session JSON or a self-contained HTML report. Your saved collections export for Bruno, Insomnia or Hoppscotch, or as one API docs page (Export docs). It also copies any single request as code in 15 languages, cURL for bash and Windows cmd included. Authorization headers, cookies and secret-shaped fields are redacted by default.

While recording, Compose and Replay send through the page you are testing, with its cookies and session. With nothing recording, Compose sends the request itself, without any page's cookies, after the browser asks once for that site. When an API blocks the page's origin (CORS), Compose offers Send from the extension instead, and a Replay is sent again from the extension by itself: no page cookies, marked FROM EXTENSION in the log. Copy as code also turns any request into cURL or another language to run outside the browser.

No. Everything RequestFox captures stays in your browser's storage on your device. There is no RequestFox server, no analytics and no account. Authorization headers, cookies and secret-shaped fields are redacted by default in everything RequestFox keeps, logs or exports (Compose shows the answer to your own request as it came; its Recent list keeps your last 100 sends, redacted, on this device until you press Clear), and site access is asked for only when you press Start, or, for the sites involved, when you send from Compose or run a test suite with nothing recording.

RequestFox is free, and our promise is written here: nothing you can use for free today will be put behind a paywall later. Its code is MIT-licensed and ships readable inside the extension; the source repository is not public. It has no ads, no account and no paid tier.

The interface is available in 14 languages: English, Arabic (right to left), Chinese (Simplified), French, German, Hindi, Indonesian, Italian, Japanese, Korean, Portuguese (Brazil), Russian, Spanish and Turkish. It follows the browser's language, or you can pick one in Settings.