In-Browser Console

Try API

Select an endpoint, paste your test key, and click send. The console signs requests using HMAC-SHA256 via WebCrypto directly inside your browser tab and calls the test-mode host directly; zero credentials pass through documentation servers. Output includes reproducible cURL commands for terminal use.

Strictly use test key tke_test_ / tke_member_test_

The console signs requests directly in your browser and calls the API directly. Live keys tke_live_ / tke_member_live_ are blocked because placing orders or topups with live keys debits actual organization funds. Your pasted secret stays strictly in transient tab memory: never saved to storage, never dispatched anywhere other than your signed request.

1. API Key & Environment

API Key ID (must have prefix tke_test_ / tke_member_test_)

API Secret

Resides in tab memory only. Lost when tab is closed.

Base URL

2. Select Endpoint

Filter endpoints...

Catalog

Orders

eSIMs

Wallet

Webhooks

Test Mode

GET/v1/catalog/packagesscope catalog:read

3. Parameters & Request Body

Query Parameters

Optional. Used for pagination/reconciliation: page_size, cursor, updated_since.

Outgoing RequestGET https://api-testing.tongkhoesim.com/v1/catalog/packages

4 headers X-TKE-* signed automatically.

Where Your Secret Goes

Your secret resides exclusively in transient tab memory and is used solely to compute HMAC signatures. It is never stored in browser storage (no localStorage, no cookies), never placed in URLs, and never sent to our documentation servers. The only outbound request is your signed /v1 call directly to the API.

Generated cURL snippets contain only the computed signature, not your secret key: safe to copy and share, expiring after 300 seconds.

Prefer Running in Postman?

Download our automated Postman collection generated from this OpenAPI spec: includes {{base_url}}, {{key_id}}, {{secret}} variables and pre-request HMAC signing scripts.

Download Postman Collection