#1cURL cheatsheet for the flags developers actually use

What we tested: We sent requests from our browser-based HTTP tools to test endpoints on localhost and remote servers. Header inspection, status code handling, and CORS preflight behavior were verified against Express.js, Fastify, and nginx backends.

curl is the fastest way to make a real HTTP request from the terminal, but only if you know the few flags you reach for most often.

This cheatsheet focuses on those day-to-day cases: methods, headers, JSON bodies, file uploads, cookies, and timing.

#2The Essentials, HTTP Methods

#3GET

curl https://api.example.com/users

Add -i to see response headers. Add -s to suppress the progress meter (useful in scripts). Add -o output.json to save the body to a file.

curl -i -s https://api.example.com/users

#3POST with JSON body

curl -X POST https://api.example.com/users \
  -H "Content-Type: application/json" \
  -d '{"name": "Alice", "email": "alice@example.com"}'

-d reads from a string. -d @file.json reads from a file. Use --data-binary @file.json when the file contains newlines that must be preserved (e.g., webhook payloads).

# Read body from a file
curl -X POST https://api.example.com/users \
  -H "Content-Type: application/json" \
  -d @user.json

#3PUT, full replacement

curl -X PUT https://api.example.com/users/42 \
  -H "Content-Type: application/json" \
  -d '{"name": "Alice Smith", "email": "alice@example.com"}'

#3PATCH, partial update

curl -X PATCH https://api.example.com/users/42 \
  -H "Content-Type: application/json" \
  -d '{"email": "newemail@example.com"}'

#3DELETE

curl -X DELETE https://api.example.com/users/42

#3HEAD, get response headers only (no body)

curl -I https://api.example.com/users

-I (uppercase i) is shorthand for --head. Useful for checking Content-Type, Cache-Control, or whether a URL redirects.

#3OPTIONS, inspect CORS preflight

curl -X OPTIONS https://api.example.com/users \
  -H "Origin: https://myapp.com" \
  -H "Access-Control-Request-Method: POST" \
  -H "Access-Control-Request-Headers: Content-Type, Authorization" \
  -i

#2Authentication

#3Bearer token

curl https://api.example.com/users \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiJ9..."

#3Basic Auth

# curl encodes the credentials as Base64 automatically
curl https://api.example.com/admin \
  -u username:password

# Equivalent manual form
curl https://api.example.com/admin \
  -H "Authorization: Basic $(echo -n 'username:password' | base64)"

Tip: If the password contains special characters, wrap the whole username:password in single quotes.

#3API key in a header

curl https://api.example.com/data \
  -H "X-API-Key: your-api-key-here"

#3API key in a query parameter

curl "https://api.example.com/data?api_key=your-api-key-here"

#3OAuth 2.0, get an access token with client credentials

curl -X POST https://auth.example.com/oauth/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials&client_id=CLIENT_ID&client_secret=CLIENT_SECRET&scope=read"

#2Headers

#3Set a single header

curl https://api.example.com \
  -H "Accept: application/json"

#3Set multiple headers

curl https://api.example.com \
  -H "Content-Type: application/json" \
  -H "Accept-Language: en-US" \
  -H "X-Request-ID: abc-123"

#3Set a custom User-Agent

curl https://api.example.com \
  -H "User-Agent: MyApp/1.0"

#3View all response headers

curl -D - https://api.example.com/users

-D - dumps response headers to stdout (before the body). -D headers.txt saves them to a file.

#2Query Parameters

# URL-encode manually
curl "https://api.example.com/search?q=hello+world&limit=10&page=2"

# Use --get (-G) with --data-urlencode for automatic encoding
curl -G https://api.example.com/search \
  --data-urlencode "q=hello world" \
  --data-urlencode "filter=status:active"

--data-urlencode is essential when values contain spaces, &, +, or =.

#2Request Body Formats

#3JSON

curl -X POST https://api.example.com/data \
  -H "Content-Type: application/json" \
  -d '{"key": "value"}'

#3Form data (application/x-www-form-urlencoded)

curl -X POST https://api.example.com/login \
  -d "username=alice&password=secret"

#3Multipart form data (file upload)

curl -X POST https://api.example.com/upload \
  -F "file=@/path/to/file.pdf" \
  -F "description=My document"

-F creates a multipart/form-data request. @ prefix tells curl to read from a file. Without @, the value is treated as a string.

#3Upload a raw binary file

curl -X PUT https://api.example.com/files/image.png \
  -H "Content-Type: image/png" \
  --data-binary @image.png

#2Response Handling

#3Save response body to a file

curl -o output.json https://api.example.com/data

#3Save with the server's filename (Content-Disposition)

curl -O https://example.com/downloads/report.pdf

#3Pretty-print JSON response with jq

curl -s https://api.example.com/users | jq '.'
# Filter a specific field
curl -s https://api.example.com/users | jq '.[0].email'
# Filter an array
curl -s https://api.example.com/users | jq '[.[] | select(.active == true)]'

#3Show only the HTTP status code

curl -o /dev/null -w "%{http_code}" -s https://api.example.com/health

#3Show full timing breakdown

curl -o /dev/null -s -w "\
DNS lookup:        %{time_namelookup}s\n\
TCP connect:       %{time_connect}s\n\
TLS handshake:     %{time_appconnect}s\n\
Time to first byte: %{time_starttransfer}s\n\
Total time:        %{time_total}s\n\
" https://api.example.com

#2Redirects

#3Follow redirects

curl -L https://example.com

#3Follow redirects with a max limit

curl -L --max-redirs 5 https://example.com

#3Show the final URL after redirects

curl -Ls -o /dev/null -w "%{url_effective}" https://short.url/abc

#2SSL & TLS

#3Ignore SSL certificate errors (dev only)

curl -k https://localhost:3000/api
# Or
curl --insecure https://localhost:3000/api

⚠️ -k disables certificate verification entirely. Never use in production scripts, it silently opens the door to man-in-the-middle attacks.

#3Use a custom CA certificate

curl --cacert /path/to/ca.pem https://internal.example.com

#3Specify TLS version

curl --tls-max 1.3 --tlsv1.3 https://api.example.com

#3Show TLS certificate details

curl -v --silent https://api.example.com 2>&1 | grep -A5 "Server certificate"

#2Cookies

#3Send cookies

curl https://api.example.com/dashboard \
  -H "Cookie: session=abc123; user_id=42"

#3Save cookies to a file (cookie jar)

curl -c cookies.txt https://api.example.com/login \
  -d "username=alice&password=secret"

#3Load cookies from a file for subsequent requests

curl -b cookies.txt https://api.example.com/dashboard

#3Combined, save and load (session simulation)

# Step 1: Login and save cookie
curl -c cookies.txt -X POST https://api.example.com/login \
  -d "username=alice&password=secret"

# Step 2: Access protected route with saved cookie
curl -b cookies.txt https://api.example.com/profile

#2Parallel Requests

#3Send multiple URLs in one command (sequential)

curl \
  https://api.example.com/users \
  https://api.example.com/products \
  https://api.example.com/orders

#3Parallel requests (curl 7.66+)

curl --parallel \
  https://api.example.com/users \
  https://api.example.com/products \
  https://api.example.com/orders

#3Parallel with output to separate files

curl --parallel \
  -o users.json https://api.example.com/users \
  -o products.json https://api.example.com/products \
  -o orders.json https://api.example.com/orders

#2Verbose Debugging

#3Full request and response trace

curl -v https://api.example.com

-v shows request headers (prefixed >), response headers (prefixed <), and TLS handshake details.

#3Trace everything (byte-level)

curl --trace-ascii /dev/stdout https://api.example.com

#3Show only request headers sent

curl -v -o /dev/null https://api.example.com 2>&1 | grep "^>"

#2Timeouts and Retries

#3Set connection timeout

curl --connect-timeout 5 https://api.example.com

#3Set max total time

curl --max-time 30 https://api.example.com

#3Retry on failure

curl --retry 3 --retry-delay 2 --retry-connrefused https://api.example.com

--retry 3, try 3 additional times on failure
--retry-delay 2, wait 2 seconds between retries
--retry-connrefused, also retry on connection refused (not just HTTP errors)

#2Proxy

#3Route through an HTTP proxy

curl -x http://proxy.example.com:8080 https://api.example.com

#3Route through SOCKS5 proxy

curl --socks5 127.0.0.1:1080 https://api.example.com

#3Bypass proxy for specific hosts

curl -x http://proxy.example.com:8080 \
  --noproxy "localhost,127.0.0.1" \
  https://api.example.com

#2Config File, Save Common Options

Instead of repeating flags every time, put your defaults in ~/.curlrc:

# ~/.curlrc
silent                 # suppress progress meter
location               # follow redirects
connect-timeout = 10   # 10 second connect timeout
max-time = 60          # 60 second total timeout

#2Most Common Mistakes

• Using -d instead of --data-binary for webhook replay. -d strips newlines, breaking HMAC signatures that are computed over raw bytes.
• Forgetting -L and getting a redirect HTML page instead of JSON. Add -L whenever you hit shortened URLs or HTTP→HTTPS redirects.
• Using -k in a shell script that runs in CI. A -k flag that slips into a production script silently accepts any certificate. If you need to test against a self-signed cert, use --cacert with the cert file instead.
• Wrapping URL in double quotes with & in query params on Windows. The shell interprets & as a command separator. Always wrap URLs containing & in double quotes on Windows, or use ^& to escape.
• Piping to jq without -s. Without the -s (silent) flag, curl mixes the progress meter into stdout and jq fails to parse the JSON.

#2Try It In Your Browser

Prefer a visual interface? The AllDevToolsHub API Tester is a browser-based Postman alternative, build GET, POST, PUT, DELETE requests with headers, auth, query parameters, and body without memorising curl flags. Requests are made directly from your browser; no data is sent to AllDevToolsHub's servers.

For webhook-specific testing with provider-specific signature verification, see the Webhook Tester. For JWT inspection without a curl pipeline, use the JWT Decoder.

#2Frequently Asked Questions

#3What is the difference between -d and --data-binary?

-d (--data) strips newline characters from the input and treats @filename references as text files. --data-binary sends the data exactly as-is, byte for byte. Use --data-binary whenever you are sending files, binary content, or webhook payloads where exact bytes matter (e.g., HMAC signature verification).

#3How do I send a DELETE request with a JSON body?

curl -X DELETE https://api.example.com/items \
  -H "Content-Type: application/json" \
  -d '{"ids": [1, 2, 3]}'

DELETE requests can have a body, curl supports it, and most frameworks accept it, though some REST purists argue against it.

#3How do I test if an endpoint redirects correctly?

curl -o /dev/null -s -w "%{http_code} %{redirect_url}\n" https://example.com/old-path

This shows the status code and the URL it redirected to without following the redirect.

#3How do I use curl in a shell script safely?

Always set -f (--fail) so curl exits with a non-zero code on HTTP errors (4xx/5xx), without it, curl exits 0 even if the server returns a 500. Combine with set -e in bash scripts so the script aborts on failure:

#!/bin/bash
set -e
response=$(curl -sf https://api.example.com/health)
echo "Health: $response"

#3Can I use curl to test WebSocket connections?

curl 7.86+ supports WebSocket (ws:// and wss://) via the --websocket flag, but it is limited to simple message exchange. For full interactive WebSocket testing with a browser UI, use the WebSocket Tester.

Written by Rahul Jalavadiya, founder of AllDevToolsHub. All tools run locally in your browser.

#2Sources / Further reading

• curl - Official documentation
• IETF - RFC 9110: HTTP Semantics
• IETF - RFC 6455: The WebSocket Protocol
• IETF - RFC 7540: HTTP/2

#2Try These Tools

• Http Request Builder
• Dns Lookup