← All guides

A reqres alternative that doesn't change under you

For years, reqres.in was the answer to "I need a fake API to test my login form / HTTP client / users list right now." Then it started changing. In July 2026 every request suddenly required an x-api-key header — the famous tutorial curl returned 401 missing_api_key, and so did every code sample in a decade of blog posts, courses, and Stack Overflow answers (we verified it live at the time). By late August 2026 the wall was gone again — keyless requests work — but the responses came back different:

curl -X POST https://reqres.in/api/login \
  -H 'content-type: application/json' \
  -d '{"email":"eve.holt@reqres.in","password":"cityslicka"}'
# → 200 {"token":"QpwL5tke4Pnpja7X4",
#        "_meta":{"powered_by":"ReqRes","upgrade_url":"...","cta":{...},
#                 "message":"This is a read-only demo endpoint. Sign up to ..."}}

Every JSON response now carries an injected _meta marketing object — upgrade URLs, a CTA, an A/B-test variant tag (verified live Aug 30, 2026). Lenient parsers shrug it off; exact-shape snapshot tests, strict decoders (Zod .strict(), serde deny_unknown_fields), and response-schema assertions all break. Writes are still theater — POST /api/users answers 201 with an id, but GETting that id is a 404. And requests from cloud/CI IPs get aggressively rate-limited: our uptime tracker, probing just once every 30 minutes from a datacenter IP, was 429'd on roughly two-thirds of its checks over the last day (residential browsers seem fine — your CI may not be).

An API you test against shouldn't be a moving target. Here's how to get the same thing on Mockbird — no API key, no signup, CORS on, no ads in your JSON — plus a few things reqres never did, like tokens that are real signed JWTs and writes that actually persist.

The 30-second replacement

Two requests: create a project, add a seeded users resource.

curl -X POST https://mockbird.mockbird.workers.dev/api/projects \
  -H 'content-type: application/json' -d '{"name":"my-fake-api"}'
# → {"id":"abc123","adminKey":"KEY","baseUrl":"https://mockbird.mockbird.workers.dev/m/abc123", ...}

curl -X POST https://mockbird.mockbird.workers.dev/api/projects/abc123/resources \
  -H 'X-Admin-Key: KEY' -H 'content-type: application/json' \
  -d '{"name":"users","fields":[
        {"name":"firstName","type":"firstName"},
        {"name":"lastName","type":"lastName"},
        {"name":"email","type":"email"},
        {"name":"avatar","type":"avatar"}
      ],"seed":12}'

You now have 12 realistic users (names, emails, avatar URLs served by your own project — initials SVGs, no third-party image service) at your own base URL. No header needed on any request that follows.

The reqres greatest hits, translated

curl "https://mockbird.mockbird.workers.dev/m/abc123/users?_page=2&_limit=6"

curl -X POST "https://mockbird.mockbird.workers.dev/m/abc123/auth/login" \
  -H 'content-type: application/json' \
  -d '{"email":"eve.holt@reqres.in","password":"cityslicka"}'
# → {"token":"eyJhbGciOiJIUzI1NiIs...","tokenType":"Bearer","expiresIn":3600,"user":{...}}

Where it's more than a drop-in

The token is a real signed JWT, not reqres's fixed QpwL5tke4Pnpja7X4 string. It has iat/exp claims, and you control the lifetime — pass "expiresIn": 5 at login and you can watch your app handle token expiry five seconds later, without waiting an hour or faking clocks. There's a whole guide on the mock-auth endpoints.

Login as a seeded user returns that user. If the email you log in with matches a record in your users resource, the response's user object (and GET /auth/me with the token) is that live record — password-ish fields stripped. Registration inserts a real record:

curl -X POST "https://mockbird.mockbird.workers.dev/m/abc123/auth/register" \
  -H 'content-type: application/json' \
  -d '{"email":"new.user@example.com","password":"pistol"}'
# → token + {"user":{"email":"new.user@example.com","id":13}}

curl "https://mockbird.mockbird.workers.dev/m/abc123/users/13"   # → 200, it's really in the list

Reqres's register was response-only theater — the user never existed afterwards. Here your list view, your "welcome" flow, and your test assertions all see the same data.

Optional protected mode: flip one setting and every endpoint returns a proper 401 without a Bearer token — so you can test your interceptors and redirect-to-login logic against a server that actually enforces auth. And unlike reqres's fixed user roster, the schema is yours: add role, plan, whatever fields your UI needs, or go beyond users entirely — any resource, GraphQL, generated TypeScript types, Postman collections, snapshots for deterministic tests.

Honest comparison

Where reqres still wins: it's a well-known URL with a hosted UI, and the fixed dataset means everyone sees identical data — that predictability is genuinely useful in classrooms (when the response shape isn't mid-migration). This page is written by the Mockbird maker — bias disclosed. Reqres behavior verified live: 401 missing_api_key on all unauthenticated requests in July 2026; keyless access restored but with injected _meta objects, faked writes (POST 201 → GET 404), and datacenter-IP 429s as of Aug 30, 2026 — see live status. Anonymous Mockbird projects have a per-IP daily creation cap; sign up (free) to keep projects permanently.

Full API reference in the docs. More guides: mock JWT auth in depth · fake user API (randomuser.me alternative) · JSONPlaceholder alternative · 5 free mock-API tools compared. Create your API →