What Is cURL?
cURL is a command-line tool for making HTTP (and other protocol) requests. It is pre-installed on macOS and Linux and available for Windows. Developers use it to test APIs, debug network requests, download files, and automate data transfers. When you click "Copy as cURL" in Chrome DevTools, the result is a cURL command you can replay from the terminal.
The Most Important Flags
-X or --request: Sets the HTTP method. Without it, cURL defaults to GET. Use -X POST, -X PUT, -X DELETE, or -X PATCH as needed.
-H or --header: Adds an HTTP header. Use one -H flag per header. Example: -H "Content-Type: application/json" -H "Authorization: Bearer token123".
-d or --data: Sends a request body. Implies POST if no -X is given. Use --data-raw to send data that contains the @ character without cURL trying to read it as a file path.
-u or --user: Sends HTTP Basic Authentication credentials. Format is username:password. cURL encodes them as a Base64 Authorization header automatically.
-o: Saves the response body to a file instead of printing it to stdout.
-v: Verbose mode. Prints the full request and response including headers, useful for debugging.
-L or --location: Follows HTTP redirects. Without it, cURL stops at the first redirect response.
--compressed: Requests compressed response and decompresses it automatically. Use this when the API supports gzip.
-k or --insecure: Skips SSL certificate verification. Use only for local development or private networks -- never in production scripts.
Making a GET Request
The simplest cURL command is just curl followed by a URL. cURL sends a GET request and prints the response body. To add query parameters, include them in the URL: curl "https://api.example.com/users?page=2&limit=10".
Sending JSON
To send a JSON body, set the Content-Type header and provide the data with -d. Single quotes around the JSON body prevent the shell from interpreting the curly braces. On Windows, use double quotes and escape the inner quotes.
Using Authentication
For Bearer tokens, add -H "Authorization: Bearer your_token_here". For Basic auth, use -u username:password. cURL sends the credentials as a Base64-encoded Authorization header.
Converting cURL to Code
Once you have a working cURL command, you often need to reproduce it in application code. The translation is mechanical but tedious -- each flag maps to a property in the HTTP client of your chosen language.
In JavaScript fetch, the method, headers, and body map directly to the second argument object. In Python requests, headers is a dict, and the body goes into the data or json parameter. In Axios, the config object mirrors the same structure. In PHP, each curl_setopt call sets one property of the curl handle.
Converting manually takes time and is error-prone when headers or bodies contain special characters. A converter tool handles the translation automatically, including Base64 encoding credentials and properly quoting string values.
Multiline cURL Commands
Long cURL commands are split across lines using a backslash at the end of each line. This is a shell line-continuation character and is purely cosmetic -- the command is equivalent to one long line. Paste the whole multiline block into a converter or terminal; both handle it correctly.
Debugging with cURL
Use -v to see the full HTTP exchange. The lines starting with > show the request headers, and the lines starting with < show the response headers. The response body follows after a blank line.
Use -w "%{http_code}" to print just the HTTP status code, which is useful in scripts: curl -o /dev/null -s -w "%{http_code}" https://example.com.
Security Considerations
Never include API keys or passwords directly in cURL commands you share publicly. Commands appear in shell history and can be captured in logs. Use environment variables for secrets and reference them in commands: -H "Authorization: Bearer $API_KEY".