A reqres alternative that still works without an API key

For years, reqres.in was the answer to "I need a fake API to test my login form / HTTP client / users list right now." Then it changed: every request to reqres now requires an x-api-key header. The famous tutorial curl —

curl -X POST https://reqres.in/api/login \
  -H 'content-type: application/json' \
  -d '{"email":"eve.holt@reqres.in","password":"cityslicka"}'
# → 401 {"error":"missing_api_key", ...}

— now returns 401 missing_api_key (verified July 2026), and so does every code sample in a decade of blog posts, courses, and Stack Overflow answers. The key is free, but it means a signup, a dashboard, and a header you have to thread through every snippet — exactly the friction reqres existed to avoid.

Here's how to get the same thing on Mockbird — no API key, no signup, CORS on — plus a few things reqres never did, like tokens that are real signed JWTs and writes that actually persist.

The 30-second replacement

Two requests: create a project, add a seeded users resource.

curl -X POST https://HOST/api/projects \
  -H 'content-type: application/json' -d '{"name":"my-fake-api"}'
# → {"id":"abc123","adminKey":"KEY","baseUrl":"https://HOST/m/abc123", ...}

curl -X POST https://HOST/api/projects/abc123/resources \
  -H 'X-Admin-Key: KEY' -H 'content-type: application/json' \
  -d '{"name":"users","fields":[
        {"name":"firstName","type":"firstName"},
        {"name":"lastName","type":"lastName"},
        {"name":"email","type":"email"},
        {"name":"avatar","type":"avatar"}
      ],"seed":12}'

You now have 12 realistic users (names, emails, dicebear avatar URLs — same vibe as reqres's roster) at your own base URL. No header needed on any request that follows.

The reqres greatest hits, translated

You used to call	Now call
`GET /api/users?page=2`	`GET /users?_page=2&_limit=6` (total in `X-Total-Count` header)
`GET /api/users/2`	`GET /users/2`
`GET /api/users/23` → 404	`GET /users/23` → 404, same
`POST /api/login`	`POST /auth/login` — any email + password works
`POST /api/register`	`POST /auth/register` — creates a real user record
`GET /api/users?delay=3`	`GET /users?mock_delay=3000`
magic emails for 400 errors	`?mock_status=400` (or 401, 500, …) on any endpoint

curl "https://HOST/m/abc123/users?_page=2&_limit=6"

curl -X POST "https://HOST/m/abc123/auth/login" \
  -H 'content-type: application/json' \
  -d '{"email":"eve.holt@reqres.in","password":"cityslicka"}'
# → {"token":"eyJhbGciOiJIUzI1NiIs...","tokenType":"Bearer","expiresIn":3600,"user":{...}}

Where it's more than a drop-in

The token is a real signed JWT, not reqres's fixed QpwL5tke4Pnpja7X4 string. It has iat/exp claims, and you control the lifetime — pass "expiresIn": 5 at login and you can watch your app handle token expiry five seconds later, without waiting an hour or faking clocks. There's a whole guide on the mock-auth endpoints.

Login as a seeded user returns that user. If the email you log in with matches a record in your users resource, the response's user object (and GET /auth/me with the token) is that live record — password-ish fields stripped. Registration inserts a real record:

curl -X POST "https://HOST/m/abc123/auth/register" \
  -H 'content-type: application/json' \
  -d '{"email":"new.user@example.com","password":"pistol"}'
# → token + {"user":{"email":"new.user@example.com","id":13}}

curl "https://HOST/m/abc123/users/13"   # → 200, it's really in the list

Reqres's register was response-only theater — the user never existed afterwards. Here your list view, your "welcome" flow, and your test assertions all see the same data.

Optional protected mode: flip one setting and every endpoint returns a proper 401 without a Bearer token — so you can test your interceptors and redirect-to-login logic against a server that actually enforces auth. And unlike reqres's fixed user roster, the schema is yours: add role, plan, whatever fields your UI needs, or go beyond users entirely — any resource, GraphQL, generated TypeScript types, Postman collections, snapshots for deterministic tests.

Honest comparison

	reqres.in	Mockbird
Works without an API key	no — `x-api-key` on every request (free key, signup required)	yes
Users + pagination	fixed 12-user roster	your own seeded roster, any size/schema
Login / register	fixed token string, magic emails only	any credentials, real signed JWT, configurable expiry
Registered users persist	no	yes — visible via REST/GraphQL
Delay / error simulation	`?delay=` only	`?mock_delay=` + `?mock_status=` on any endpoint
Auth enforcement to test against	no	optional protected mode (401 without Bearer)
Limits	free key tier	10,000 requests/day per project, free

Where reqres still wins: if you (or your course's students) already have a key, it's a stable, well-known URL with a hosted UI, and the fixed dataset means everyone sees identical data — that predictability is genuinely useful in classrooms. This page is written by the Mockbird maker — bias disclosed. Reqres behavior (401 missing_api_key on unauthenticated requests, including /api/login) verified live in July 2026. Anonymous Mockbird projects have a per-IP daily creation cap; sign up (free) to keep projects permanently.

Full API reference in the docs. More guides: mock JWT auth in depth · JSONPlaceholder alternative · 5 free mock-API tools compared. Create your API →