cURL Command Generator & Builder

What Is a curl Command?

# Plain GET — curl defaults to GET
curl https://api.example.com/users

# GET with a Bearer token (auth is just a header)
curl https://api.example.com/me \
  -H 'Authorization: Bearer YOUR_TOKEN'

# POST a JSON body — note the Content-Type header
curl -X POST https://api.example.com/users \
  -H 'Content-Type: application/json' \
  -d '{"name":"Ada","role":"admin"}'

# Multipart file upload — '@' reads the file from disk
curl -X POST https://api.example.com/upload \
  -F 'file=@report.pdf' \
  -F 'title=Q3 report'

Key Features

curl Alternatives & HTTP Clients

curl Command Examples

curl https://api.example.com/users

curl https://api.example.com/me \
  -H 'Authorization: Bearer YOUR_TOKEN'

curl -X POST https://api.example.com/users \
  -H 'Content-Type: application/json' \
  -d '{"name":"Ada","role":"admin"}'

curl -X POST https://api.example.com/login \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d 'username=ada&password=s3cret'

curl -X POST https://api.example.com/upload \
  -F 'file=@report.pdf' \
  -F 'title=Q3 report'

curl -L -o archive.zip \
  https://example.com/files/archive.zip

curl -u ada:s3cret \
  https://api.example.com/private

curl -v -i https://api.example.com/health

How to Build a curl Command

1. 1

   Choose the HTTP method

   Select GET, POST, PUT, PATCH, DELETE, HEAD, or OPTIONS. curl defaults to GET; picking POST or another verb adds `-X METHOD` to the generated command. Or tap a preset chip to set the method and a matching body in one click.

2. 2

   Enter the URL and query parameters

   Type the request URL (e.g. `https://api.example.com/users`). Add query parameters as key/value pairs and the tool URL-encodes them and appends `?key=value&…` to the URL automatically — no manual encoding needed.

3. 3

   Add headers and authentication

   Add request headers as key/value pairs, then choose an auth scheme: None, Bearer token, Basic (username/password), or a custom API-key header. The correct `Authorization` or custom header is generated in the exact format the server expects.

4. 4

   Set the request body

   For POST/PUT/PATCH, choose a body type: paste raw JSON (the `Content-Type` header is added for you), build urlencoded form fields, or assemble a multipart upload and toggle any field to a file with the `@` prefix.

5. 5

   Toggle options

   Flip on the flags you need — follow redirects (`-L`), insecure TLS (`-k`), verbose (`-v`), include headers (`-i`), compressed (`--compressed`), output to file (`-o`), a connect timeout, or a proxy (`-x`). Each toggle updates the command live.

6. 6

   Copy, export, or reset

   Copy the finished command, Export .sh to download it as a script, or Reset to clear the form. Use the Multi-line toggle to switch between single-line and backslash-continued output before you copy.

Common curl Mistakes

# Intended a PATCH, but -d alone implies POST
curl -d '{"role":"admin"}' \
  https://api.example.com/users/7

# Set the verb explicitly
curl -X PATCH -d '{"role":"admin"}' \
  -H 'Content-Type: application/json' \
  https://api.example.com/users/7

# Server sees urlencoded, not JSON — 400/415
curl -X POST https://api.example.com/users \
  -d '{"name":"Ada"}'

# Declare the JSON content type
curl -X POST https://api.example.com/users \
  -H 'Content-Type: application/json' \
  -d '{"name":"Ada"}'

# $name gets expanded by the shell to empty string
curl -d "{\"user\":\"$name\"}" \
  https://api.example.com/users

# Single quotes send the body literally
curl -d '{"user":"$name"}' \
  https://api.example.com/users

# -d makes this a POST, not a GET
curl -d 'page=2&limit=50' \
  https://api.example.com/users

# Query string on the URL keeps it a GET
curl 'https://api.example.com/users?page=2&limit=50'

:: cmd.exe — backslash is not a continuation char
curl -X POST https://api.example.com/users \
  -d '{"name":"Ada"}'

:: cmd.exe — one line, or use ^ to continue
curl -X POST https://api.example.com/users -d "{\"name\":\"Ada\"}"

# Space splits the argument — curl sees two args
curl https://api.example.com/search?q=hello world

# Encode the space (or quote the whole URL)
curl 'https://api.example.com/search?q=hello%20world'

Common Use Cases

REST API Testing

Build and fire requests against a REST endpoint without leaving the terminal: set the method, paste a Bearer token, send a JSON body, and read the response. The fastest way to confirm an API behaves before writing client code.

Reproducing a Request from Docs

API documentation shows endpoints and parameters but rarely a complete, copy-ready command. Fill in the method, URL, headers, and auth here and get a curl command that runs as-is — no fighting with quoting or missing `Content-Type` headers.

CI/CD Smoke-Test Scripts

Generate a curl command for a health check or post-deploy smoke test, then Export .sh to drop it into a pipeline. Add `--connect-timeout` and `--max-time` so a hung endpoint can't block the build, and check status codes with `-w`.

File Upload & Download

Assemble a `multipart/form-data` upload with `-F field=@file`, or build a `-L -o filename` download that follows redirects to a CDN. Encode any tricky filenames or query values first with our URL encoder.

Webhook Debugging

Replay a webhook payload by POSTing the same JSON body the provider sends, with the right signature and `Content-Type` headers. Reproduce the exact request locally to debug why your handler rejected it.

Reproducible Bug Reports

Paste a single self-contained curl command into a bug report or PR so anyone can reproduce the exact request — method, headers, auth placeholder, and body. Far clearer than describing the request in prose.

Learning curl Flags

See how each form choice maps to a real flag — pick Basic auth and watch `-u` appear, add a JSON body and watch the `Content-Type` header attach. A hands-on way to learn the syntax, paired with our curl cheat sheet.

Prepping a Request to Convert to Code

Build and verify the request as curl first, then translate it to your app's HTTP client. The upcoming Convert tab will turn a pasted curl command into fetch, requests, Go, PHP, Ruby, and Node.js — start from a curl command you know works.

curl Flags & Syntax Reference

Shell Quoting & Escaping

The tool wraps values in single quotes, the safest form in POSIX shells because nothing inside a single-quoted string is expanded. A literal single quote inside a value is emitted as the `'\''` sequence (close-quote, escaped quote, reopen-quote). On `cmd.exe` switch to double quotes; Git Bash and WSL run the generated single-quote commands unchanged.

-d vs --data-raw vs --data-binary

`-d`/`--data` strips newlines and carriage returns from the body — fine for `key=value` pairs, lossy for multi-line content. `--data-raw` is the same but won't treat a leading `@` as a filename. `--data-binary` sends bytes exactly as given (use `@file` to upload raw file contents). All three imply POST unless the method is overridden.

Multipart (-F) vs URL-encoded (-d)

`-F field=value` produces `multipart/form-data` with a generated boundary — required for file uploads (`-F file=@path`) and mixed file/text forms. `-d field=value` produces `application/x-www-form-urlencoded`, a single `&`-joined string. Never set `Content-Type` manually for multipart; curl computes the boundary and sets the header itself.

Auth Header Encoding

Bearer auth sends `Authorization: Bearer ` verbatim (RFC 6750). Basic auth from `-u user:pass` is Base64-encoded into `Authorization: Basic ` over the wire — encoding, not encryption, so use HTTPS. An API key is whatever custom header the service requires, e.g. `X-API-Key: `.

Query-String Encoding

Query parameters added in the builder are percent-encoded and appended as `?key=value&key2=value2`. Reserved characters (spaces, `&`, `=`, `#`) are escaped so the URL is valid. For body fields that must be encoded, curl's own `--data-urlencode` handles encoding at request time.

Redirect Behavior (-L)

Without `-L`, curl prints a 301/302 response and stops. With `-L` it follows the `Location` header to the final URL. Note that curl drops the `Authorization` header when a redirect crosses to a different host (a security default); use `--location-trusted` only when you understand the implications.

Compressed Responses

`--compressed` adds an `Accept-Encoding` header advertising gzip/deflate/brotli support and transparently decompresses the response, saving bandwidth. The decoded body is identical to an uncompressed request — purely a transfer optimization, safe to enable on most API calls.

Output: -o vs -O

`-o filename` writes the response body to a file you name; `-O` saves it under the remote filename from the URL path. Both suppress the normal stdout dump. Combine with `-L` so redirects resolve to the real asset before the file is written.

Best Practices for curl Requests

Never Hard-Code Secrets in Shared Commands

A curl command you paste into a PR, a ticket, or a chat will be read by others and indexed by tools. Replace tokens and passwords with a placeholder (`YOUR_TOKEN`) or reference an environment variable (`-H "Authorization: Bearer $API_TOKEN"`). For long credentials, curl can read a header from a file with `-H @headerfile` so the secret never appears in shell history.

Prefer --data-binary @file for Binary Payloads

When the body is a file whose bytes matter — an image, a signed payload, JSON where whitespace is significant — use `--data-binary @file` rather than `-d @file`. Plain `-d` strips newlines and carriage returns, silently corrupting binary and multi-line content. `--data-binary` sends the file exactly as it is on disk.

Quote Header Values

Always wrap `-H` values in quotes: `-H 'Content-Type: application/json'`. Unquoted, the space after the colon splits the argument and curl sees a malformed header. Single quotes also stop the shell from expanding `$`, `*`, and other special characters inside the value — exactly what this tool emits by default.

Use --compressed to Save Bandwidth

Add `--compressed` on API calls and downloads to request gzip/brotli encoding and have curl decompress transparently. For JSON-heavy APIs this can cut transfer size by 70–90% with no change to the response you see — a free win in scripts that poll endpoints repeatedly.

Pin Timeouts in Scripts

In any automated context, add `--connect-timeout` and `--max-time` so a slow or hung endpoint can't block a pipeline forever. A health check with `--max-time 10` fails fast and lets your CI move on. Pair with `--retry N` to absorb transient network blips without giving up immediately.

Verify with -v Before Automating

Before baking a curl command into a script or cron job, run it once with `-v` to see the exact request line, headers, and TLS handshake. It's the fastest way to catch a wrong method, a missing `Content-Type`, or an auth header that didn't get attached — debug interactively, then remove `-v` for production.

Frequently Asked Questions