Test any API right from the browser: pick the method, add headers and a body, send — and read the status, headers and response. Requests are proxied through the server, so CORS restrictions don't apply.
CORS limits browsers only. The request is sent from the server, which has no such restriction, and the answer is relayed back to you.
Yes — add an Authorization header with your token, as you would in curl.
GET, POST, PUT, PATCH, DELETE — the full everyday REST set.