cURL Builder

How to use cURL Builder

1. Enter the URL and choose the method.
2. Add headers and a request body.
3. Copy the command — replacing any real token with a placeholder before sharing it.
4. curl does not follow redirects unless you add -L.
5. Use -i to see response headers, -v for the full exchange.
6. Windows cmd and PowerShell quote differently; PowerShell needs curl.exe for real curl.

The flags worth knowing

-X sets the method, though curl infers POST when you pass a body. -H adds a header and repeats for each one. -d sends a body and implies POST; --data-raw avoids curl interpreting an @ as a filename, which surprises people sending JSON that starts with one. -i includes response headers, -v shows the whole exchange including the TLS handshake, and -L follows redirects, which curl does not do by default — the usual reason a command returns an empty 301 body.

Quoting is where commands break

JSON contains double quotes, so the body needs single quotes around it in bash — and if the JSON itself contains a single quote, you are into escaping that no one enjoys. Windows cmd flips the convention, requiring double quotes with internal ones escaped, which is why a curl command copied from a Linux example frequently fails there. PowerShell aliases curl to Invoke-WebRequest entirely, so a genuine curl command needs curl.exe. For anything complex, put the body in a file and use -d @body.json.

Do not paste your production token into a shared example

A curl command carrying an Authorization header is a credential in plain text. It ends up in shell history, in bug reports, in screenshots and in chat logs, which is a steady source of leaked keys. Substitute a placeholder before sharing, use -H "Authorization: Bearer $TOKEN" so the value comes from the environment, and rotate anything that has been pasted somewhere you do not control.

Getting a working command straight from the browser

Your browser’s network tab has “Copy as cURL” on any request, which reproduces the exact call including every header and cookie. That is usually faster than building one by hand when you are trying to reproduce something the page did — and a reminder that those copied commands carry session cookies, so they should be treated as credentials too.