Skip to main content Skip to navigation Skip to footer
All projects
Token Grab logo

Token Grab

A tiny Chrome/Edge extension that captures request headers (like Authorization: Bearer …) from any website and lets you copy the token with one click.

Token Grab is built for developers who constantly need the bearer token their browser is already sending — to paste into an API client, a curl command, a local tool, or a test script. Instead of digging through DevTools → Network → Headers every time, you click the toolbar icon and hit Copy.

Everything stays local. Captured values are kept only in the extension’s own storage on your machine. Token Grab never sends anything to any server.

Features

  • Known token types, ready to go — watches Authorization, X-Api-Key, Api-Key, X-Auth-Token, X-Access-Token, X-Csrf-Token, and X-Session-Token out of the box (all enabled by default).
  • Custom headers — add any extra header name you like.
  • Organised popup — captured tokens are grouped by type, then by site.
  • One-click copy — every capture has a Copy button.
  • Smart stripping — copies just the token, dropping the Bearer/Basic scheme prefix (toggleable).
  • Masked by default — values are hidden in the popup with a Show/Hide toggle; copying still copies the full token.
  • Auto-expiry — optionally forget captures after 1h / 24h / 7 days.
  • Dark mode — follows your system theme.
  • At-a-glance badge — a dot on the toolbar icon marks a fresh capture.
  • Local-only — no network calls, no analytics, no accounts.

Install (load unpacked)

Token Grab is distributed as an unpacked extension. Grab the pre-built zips from the latest release, or build them yourself with ./build.ps1 / ./build.sh.

Chrome / Edge / Brave / other Chromium

  1. Download token-grab-<version>-chrome.zip from the latest release.
  2. Extract the zip to a folder — Chromium’s Load unpacked needs an unzipped folder, not the zip file.
  3. Open chrome://extensions (or edge://extensions).
  4. Turn on Developer mode (top-right).
  5. Click Load unpacked and select the extracted folder (the one containing manifest.json).
  6. Pin the extension so the toolbar button is visible.

Keep the extracted folder where it is — moving or deleting it removes the extension. Chromium also shows a “developer mode extensions” notice on startup; that’s expected for unpacked (unsigned) extensions.

Firefox

  1. Download token-grab-<version>-firefox.zip from the latest release.
  2. Open about:debugging#/runtime/this-firefox.
  3. Click Load Temporary Add-on and select the zip directly (no need to extract).

Temporary add-ons are removed when Firefox restarts. A permanent install requires signing the package via addons.mozilla.org.

Usage

  1. Browse to any site and trigger an authenticated request (load a page, run a search, etc.).
  2. A green dot appears on the toolbar icon when a matching header is captured.
  3. Click the icon — captured tokens are grouped by type (Authorization, API Key, …) and then by site, each with a Copy button.

Settings

Setting Description
Token types to capture A checkbox per known header type — all on by default. Untick the ones you don’t want.
Custom headers Extra header names to watch, one per line or comma-separated. Case-insensitive.
Strip the auth scheme When on (default), copying Authorization: Bearer abc… copies just abc….
Mask token values When on (default), the popup hides values behind dots; use Show to reveal.
Forget captures older than Auto-expiry: never (default), 1 hour, 24 hours, or 7 days.
Clear captured tokens Wipes all stored captures.

How it works

A background service worker uses the webRequest API to observe (read-only) request headers on outgoing XHR/fetch calls. When it sees a watched header with a new value, it stores the latest value per origin. Manifest V3 permits observing headers this way — Token Grab never blocks or modifies requests.

Permissions & privacy

Token Grab requests:

  • webRequest + <all_urls> — to read the configured header(s) on the sites you visit. This is broad by necessity: a token can come from any domain.
  • storage — to remember captured tokens and your settings locally.

Because it can read headers on every site, treat Token Grab as a developer tool:

  • It never transmits captured tokens — they live only in local storage.
  • Values are masked in the popup by default and can auto-expire.
  • Stored captures are bounded (max 100 origins, header values capped at 8 KB).
  • Narrow your exposure by keeping the watched-header list short.
  • Use Clear captured tokens (or uninstall) when you’re done.

No data ever leaves your browser. See the full Privacy Policy.

Compatibility

  • Chromium (Chrome, Edge, Brave, Opera, Arc, …) with Manifest V3 — uses manifest.json and a background service worker.
  • Firefox 128+ — uses manifest.firefox.json and a background event page. The shared code detects the browser and adjusts the webRequest options automatically.

License

Licensed under the Apache License 2.0 — see LICENSE and NOTICE.

You’re welcome to fork and build on this project. In return:

  • Keep attribution. Retain the copyright and NOTICE, and credit the original project (“Token Grab” by bingkil).
  • Note your changes. If you modify files, say so, as the license requires.
  • Use your own branding. The bingkil name and the logo/icon files are trademarks and are not covered by the license — replace them with your own before redistributing.

View the source on GitHub →