cURL Command Builder

What cURL is and why developers live in it

curl is a command-line program for making HTTP requests. It is the lingua franca of API work: documentation shows examples as cURL commands, support tickets paste them to reproduce bugs, and every browser's developer tools can "Copy as cURL." But the syntax is fiddly — a single request can stack a method flag, several -H header flags, an auth flag, and a --data body, all needing the right quoting. This builder lets you fill in a form and assembles the exact command for you, then shows the equivalent fetch() JavaScript so you can move between the terminal and the browser without rewriting anything by hand. It generates text only — it never sends a request, so nothing you type is transmitted anywhere; copy the result and run it in your own terminal.

How the command is assembled

The tool builds the command in a fixed, conventional order so the output reads the way an experienced developer would write it. Starting from curl, it appends:

• -v if verbose is checked, then -L for follow-redirects, then --max-time N if a timeout is set.
• -X METHOD — but only when the method is not GET, because GET is curl's default and writing -X GET is redundant noise.
• -u 'user:pass' for Basic auth, or an Authorization: Bearer … header for token auth.
• each header as -H 'Name: value', then the body via --data, then finally the URL in single quotes.

It joins these with \ and a newline so the command is laid out one flag per line — far easier to read and edit than a single long string. Note the deliberate Basic-auth difference between outputs: the cURL form uses -u 'user:pass' and lets curl encode it, while the fetch() form pre-encodes credentials with btoa() into a Basic header, because the browser has no -u equivalent.

A worked example

Suppose you set the method to POST, the URL to https://api.example.com/users, add a query parameter active=true, choose Bearer auth with a token, switch the body to the JSON tab, and enter {"name":"Ada"}. The builder produces:

• curl \
• -X POST \
• -H 'Authorization: Bearer YOUR_TOKEN' \
• -H 'Content-Type: application/json' \
• --data '{"name":"Ada"}' \
• 'https://api.example.com/users?active=true'

Two things happened automatically. First, the query parameter was URL-encoded and appended with a ? (or & if the URL already had a query string). Second, because you used the JSON body tab, the tool injected Content-Type: application/json for you — but only if you hadn't already supplied a content-type header yourself, so it never duplicates one.

The body tabs, and which to use

The body section only appears for POST, PUT, and PATCH, since GET and DELETE requests conventionally carry no body. Single quotes inside a body are escaped safely so the shell does not break the command.

Practical tips

• Reach for -v when a request misbehaves. Verbose mode prints the request and response headers and the TLS handshake — usually enough to see a wrong content-type or a missing auth header at a glance.
• Add -L for anything behind a redirect. Without follow-redirects, curl stops at the 301/302 and shows you the redirect, not the page you wanted.
• Set a timeout for scripts. --max-time stops a hung request from freezing an automated job indefinitely.
• Switch to the fetch() output to port a request into front-end code. It mirrors the same headers and body, so a working cURL call becomes a working browser call in seconds.

Common mistakes the builder prevents

• Quoting errors. Hand-written commands routinely break on a URL containing & or a JSON body containing spaces. Wrapping the URL and body in single quotes, as this tool does, avoids that.
• Forgetting the content-type. Posting JSON without Content-Type: application/json makes many servers reject or misparse the body; the JSON tab adds it automatically.
• Double-encoding query strings. Appending raw ?key=a b sends an invalid request; the tool encodes parameter values for you.
• Leaking secrets. Remember the generated command contains your token or password in plain text. Don't paste it into shared chats or commit it — and rotate any credential that ends up in a screenshot.