cURL Command Builder
Build a ready-to-copy curl command from a method, URL, headers, body, and authentication. Runs entirely in your browser.
Calculator
Generated Command
—Command Breakdown
| Part | Value |
|---|
Header Count
—
Query Count
—
Body Size
— B
Command Length
— chars
Result
—
How cURL Command Builder Works
What is curl?
curl is a command-line tool for transferring data with URLs, available on virtually every Linux, macOS, and modern Windows system. It's the standard way developers manually test an API endpoint from a terminal — send a request, inspect the response, iterate — without writing a full script or opening a GUI client. This tool builds a correctly-formed curl command from a method, URL, headers, body, and authentication, ready to paste directly into a POSIX shell (bash, zsh, sh). It doesn't execute anything itself — it only constructs the command text.
HTTP Methods
curl defaults to GET, and other methods are selected with -X — -X POST,
-X PUT, and so on. GET and HEAD normally carry no request body; POST, PUT, and PATCH
typically do, carrying the data being created or updated; DELETE usually needs neither a body nor
special headers beyond authentication.
Request Headers
Each header is added with its own -H 'Name: Value' flag. Headers carry metadata about
the request — what format the body is in (Content-Type), what the client can accept back
(Accept), and authentication credentials (Authorization). See the
API Header Inspector for what any specific
header actually means.
Authentication
Two common patterns: a Bearer token, sent as an
Authorization: Bearer <token> header (the standard way to send an OAuth access
token or API key), or Basic auth, sent via curl's own -u username:password
flag — curl handles the required Base64 encoding internally, so you never need to encode it by hand.
JSON Requests
A JSON request body is sent with -d '{"key":"value"}' alongside a
Content-Type: application/json header, which most APIs require to correctly parse the
body as JSON rather than a raw form submission. This tool adds that header automatically whenever a
JSON body is provided and you haven't already set your own Content-Type.
Form Requests
A form-encoded body looks like key1=value1&key2=value2, sent with
Content-Type: application/x-www-form-urlencoded — the same format an HTML
<form> submits by default. This tool accepts form fields as one "key=value" pair per
line and joins them into that single encoded body automatically.
Common Mistakes
- Forgetting Content-Type on a JSON request. Without it, many servers try to parse the body as plain text or form data and reject or misinterpret valid JSON.
- Manually Base64-encoding Basic auth credentials. curl's
-uflag does this automatically — hand-encoding it into an Authorization header yourself is unnecessary and easy to get wrong. - Leaving special characters unquoted in a hand-written command. A body or header
value containing a space, quote, or shell metacharacter (
$,`,&) needs proper shell quoting, or the shell will misinterpret the command entirely. This tool always quotes every value correctly, regardless of what it contains. - Confusing query parameters and body data. Query parameters belong in the URL
(visible, cacheable, length-limited); body data belongs in
-d(not URL-visible, no practical length limit for most APIs).
Related Tools
Building an API request often overlaps with other developer utility tasks: look up what a header means with the API Header Inspector, decode a response status code with the HTTP Status Code Reference, generate a test Bearer token with the JWT Generator or decode one with the JWT Decoder, fingerprint a request body with the Hash Generator, or look up a DNS record for the API's host with the DNS Record Lookup.
Accuracy & Sources
Last reviewed: August 2026. Formula source: curl(1) — POSIX command-line tool for transferring data with URLs. All calculations run in your browser. No data is sent to any server.
Frequently Asked Questions
No — it only builds the curl command text. It performs no network operations and doesn't validate that the endpoint exists; you paste and run the generated command yourself in your own terminal, whenever you choose.
A Bearer token is a single opaque credential (typically an OAuth access token or API key) sent as an Authorization header. Basic auth sends a username and password, combined and Base64-encoded by curl's -u flag automatically. Which one to use depends entirely on what the specific API you're calling expects — check its documentation.
Without an explicit Content-Type: application/json header, many servers can't tell your request body is JSON and either reject it or try to parse it as something else (like a plain form submission). This tool adds that header automatically whenever you select JSON as the body type and haven't already set your own Content-Type.
Every value — the URL, headers, and body — is quoted using the same POSIX shell-quoting algorithm Python's standard library uses (shlex.quote), which correctly escapes single quotes, spaces, and shell metacharacters like $, `, and ; so they're treated as literal data, not executed.
No — this tool generates a POSIX shell command only (bash, zsh, sh), intended to be run on Linux, macOS, or Windows Subsystem for Linux. Windows PowerShell has different quoting rules and its own curl-equivalent (Invoke-WebRequest) syntax, which isn't covered by this tool.
Yes — enter one per line in the Headers field ("Key: Value") or the Query Parameters field ("key=value"). Each line becomes its own -H flag or its own encoded query parameter in the final URL.