cURL Command Generator & Builder

What Is a curl Command?

# Plain GET — curl defaults to GET
curl https://api.example.com/users

# GET with a Bearer token (auth is just a header)
curl https://api.example.com/me \
  -H 'Authorization: Bearer YOUR_TOKEN'

# POST a JSON body — note the Content-Type header
curl -X POST https://api.example.com/users \
  -H 'Content-Type: application/json' \
  -d '{"name":"Ada","role":"admin"}'

# Multipart file upload — '@' reads the file from disk
curl -X POST https://api.example.com/upload \
  -F 'file=@report.pdf' \
  -F 'title=Q3 report'

Key Features

curl Alternatives & HTTP Clients

curl Command Examples

curl https://api.example.com/users

curl https://api.example.com/me \
  -H 'Authorization: Bearer YOUR_TOKEN'

curl -X POST https://api.example.com/users \
  -H 'Content-Type: application/json' \
  -d '{"name":"Ada","role":"admin"}'

curl -X POST https://api.example.com/login \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d 'username=ada&password=s3cret'

curl -X POST https://api.example.com/upload \
  -F 'file=@report.pdf' \
  -F 'title=Q3 report'

curl -L -o archive.zip \
  https://example.com/files/archive.zip

curl -u ada:s3cret \
  https://api.example.com/private

curl -v -i https://api.example.com/health

How to Build a curl Command

1. 1

   Choose the HTTP method

   Select GET, POST, PUT, PATCH, DELETE, HEAD, or OPTIONS. curl defaults to GET; picking POST or another verb adds -X METHOD to the generated command. Or tap a preset chip to set the method and a matching body in one click.

2. 2

   Enter the URL and query parameters

   Type the request URL (e.g. https://api.example.com/users). Add query parameters as key/value pairs and the tool URL-encodes them and appends ?key=value&… to the URL automatically — no manual encoding needed.

3. 3

   Add headers and authentication

   Add request headers as key/value pairs, then choose an auth scheme: None, Bearer token, Basic (username/password), or a custom API-key header. The correct Authorization or custom header is generated in the exact format the server expects.

4. 4

   Set the request body

   For POST/PUT/PATCH, choose a body type: paste raw JSON (the Content-Type header is added for you), build urlencoded form fields, or assemble a multipart upload and toggle any field to a file with the @ prefix.

5. 5

   Toggle options

   Flip on the flags you need — follow redirects (-L), insecure TLS (-k), verbose (-v), include headers (-i), compressed (--compressed), output to file (-o), a connect timeout, or a proxy (-x). Each toggle updates the command live.

6. 6

   Copy, export, or reset

   Copy the finished command, Export .sh to download it as a script, or Reset to clear the form. Use the Multi-line toggle to switch between single-line and backslash-continued output before you copy.

Common curl Mistakes

# Intended a PATCH, but -d alone implies POST
curl -d '{"role":"admin"}' \
  https://api.example.com/users/7

# Set the verb explicitly
curl -X PATCH -d '{"role":"admin"}' \
  -H 'Content-Type: application/json' \
  https://api.example.com/users/7

# Server sees urlencoded, not JSON — 400/415
curl -X POST https://api.example.com/users \
  -d '{"name":"Ada"}'

# Declare the JSON content type
curl -X POST https://api.example.com/users \
  -H 'Content-Type: application/json' \
  -d '{"name":"Ada"}'

# $name gets expanded by the shell to empty string
curl -d "{\"user\":\"$name\"}" \
  https://api.example.com/users

# Single quotes send the body literally
curl -d '{"user":"$name"}' \
  https://api.example.com/users

# -d makes this a POST, not a GET
curl -d 'page=2&limit=50' \
  https://api.example.com/users

# Query string on the URL keeps it a GET
curl 'https://api.example.com/users?page=2&limit=50'

:: cmd.exe — backslash is not a continuation char
curl -X POST https://api.example.com/users \
  -d '{"name":"Ada"}'

:: cmd.exe — one line, or use ^ to continue
curl -X POST https://api.example.com/users -d "{\"name\":\"Ada\"}"

# Space splits the argument — curl sees two args
curl https://api.example.com/search?q=hello world

# Encode the space (or quote the whole URL)
curl 'https://api.example.com/search?q=hello%20world'

Common Use Cases

REST API Testing

Build and fire requests against a REST endpoint without leaving the terminal: set the method, paste a Bearer token, send a JSON body, and read the response. The fastest way to confirm an API behaves before writing client code.

Reproducing a Request from Docs

API documentation shows endpoints and parameters but rarely a complete, copy-ready command. Fill in the method, URL, headers, and auth here and get a curl command that runs as-is — no fighting with quoting or missing Content-Type headers.

CI/CD Smoke-Test Scripts

Generate a curl command for a health check or post-deploy smoke test, then Export .sh to drop it into a pipeline. Add --connect-timeout and --max-time so a hung endpoint can't block the build, and check status codes with -w.

File Upload & Download

Assemble a multipart/form-data upload with -F field=@file, or build a -L -o filename download that follows redirects to a CDN. Encode any tricky filenames or query values first with our URL encoder.

Webhook Debugging

Replay a webhook payload by POSTing the same JSON body the provider sends, with the right signature and Content-Type headers. Reproduce the exact request locally to debug why your handler rejected it.

Reproducible Bug Reports

Paste a single self-contained curl command into a bug report or PR so anyone can reproduce the exact request — method, headers, auth placeholder, and body. Far clearer than describing the request in prose.

Learning curl Flags

See how each form choice maps to a real flag — pick Basic auth and watch -u appear, add a JSON body and watch the Content-Type header attach. A hands-on way to learn the syntax, paired with our curl cheat sheet.

Prepping a Request to Convert to Code

Build and verify the request as curl first, then translate it to your app's HTTP client. The upcoming Convert tab will turn a pasted curl command into fetch, requests, Go, PHP, Ruby, and Node.js — start from a curl command you know works.

curl Flags & Syntax Reference

Shell Quoting & Escaping

The tool wraps values in single quotes, the safest form in POSIX shells because nothing inside a single-quoted string is expanded. A literal single quote inside a value is emitted as the '\'' sequence (close-quote, escaped quote, reopen-quote). On cmd.exe switch to double quotes; Git Bash and WSL run the generated single-quote commands unchanged.

-d vs --data-raw vs --data-binary

-d/--data strips newlines and carriage returns from the body — fine for key=value pairs, lossy for multi-line content. --data-raw is the same but won't treat a leading @ as a filename. --data-binary sends bytes exactly as given (use @file to upload raw file contents). All three imply POST unless the method is overridden.

Multipart (-F) vs URL-encoded (-d)

-F field=value produces multipart/form-data with a generated boundary — required for file uploads (-F file=@path) and mixed file/text forms. -d field=value produces application/x-www-form-urlencoded, a single &-joined string. Never set Content-Type manually for multipart; curl computes the boundary and sets the header itself.

Auth Header Encoding

Bearer auth sends Authorization: Bearer <token> verbatim (RFC 6750). Basic auth from -u user:pass is Base64-encoded into Authorization: Basic <base64> over the wire — encoding, not encryption, so use HTTPS. An API key is whatever custom header the service requires, e.g. X-API-Key: <value>.

Query-String Encoding

Query parameters added in the builder are percent-encoded and appended as ?key=value&key2=value2. Reserved characters (spaces, &, =, #) are escaped so the URL is valid. For body fields that must be encoded, curl's own --data-urlencode handles encoding at request time.

Redirect Behavior (-L)

Without -L, curl prints a 301/302 response and stops. With -L it follows the Location header to the final URL. Note that curl drops the Authorization header when a redirect crosses to a different host (a security default); use --location-trusted only when you understand the implications.

Compressed Responses

--compressed adds an Accept-Encoding header advertising gzip/deflate/brotli support and transparently decompresses the response, saving bandwidth. The decoded body is identical to an uncompressed request — purely a transfer optimization, safe to enable on most API calls.

Output: -o vs -O

-o filename writes the response body to a file you name; -O saves it under the remote filename from the URL path. Both suppress the normal stdout dump. Combine with -L so redirects resolve to the real asset before the file is written.

Best Practices for curl Requests

Never Hard-Code Secrets in Shared Commands

A curl command you paste into a PR, a ticket, or a chat will be read by others and indexed by tools. Replace tokens and passwords with a placeholder (YOUR_TOKEN) or reference an environment variable (-H "Authorization: Bearer $API_TOKEN"). For long credentials, curl can read a header from a file with -H @headerfile so the secret never appears in shell history.

Prefer --data-binary @file for Binary Payloads

When the body is a file whose bytes matter — an image, a signed payload, JSON where whitespace is significant — use --data-binary @file rather than -d @file. Plain -d strips newlines and carriage returns, silently corrupting binary and multi-line content. --data-binary sends the file exactly as it is on disk.

Quote Header Values

Always wrap -H values in quotes: -H 'Content-Type: application/json'. Unquoted, the space after the colon splits the argument and curl sees a malformed header. Single quotes also stop the shell from expanding $, *, and other special characters inside the value — exactly what this tool emits by default.

Use --compressed to Save Bandwidth

Add --compressed on API calls and downloads to request gzip/brotli encoding and have curl decompress transparently. For JSON-heavy APIs this can cut transfer size by 70–90% with no change to the response you see — a free win in scripts that poll endpoints repeatedly.

Pin Timeouts in Scripts

In any automated context, add --connect-timeout and --max-time so a slow or hung endpoint can't block a pipeline forever. A health check with --max-time 10 fails fast and lets your CI move on. Pair with --retry N to absorb transient network blips without giving up immediately.

Verify with -v Before Automating

Before baking a curl command into a script or cron job, run it once with -v to see the exact request line, headers, and TLS handshake. It's the fastest way to catch a wrong method, a missing Content-Type, or an auth header that didn't get attached — debug interactively, then remove -v for production.

Frequently Asked Questions