curl converter

The fastest way to reproduce a request a website makes is to copy it from the browser's developer tools:

• Chrome, Edge: DevTools, Network tab, right-click the request, Copy, Copy as cURL. On Windows you get two: Copy as cURL (cmd) and Copy as cURL (bash).
• Firefox: Network Monitor, right-click the request, Copy Value, Copy as cURL. On Windows there is a POSIX and a Windows version.
• Safari: Web Inspector, Network tab, right-click the request, Copy as cURL.

The bash version quotes values with '...' and uses $'...' for bytes like newlines. The cmd version escapes with ^ and ends lines with ^ instead of \. The converter detects which one you pasted; the Shell switch overrides it. A copied request includes your cookies and tokens, so treat it like a password.

These are the options that change the request, and what they become in three common targets:

curl itself does not follow redirects without -L, but most libraries do. requests follows them for every method except HEAD, Go's client follows up to 10, and fetch follows them unless you set redirect: 'manual'. If the code must stop at a redirect like curl does, turn that off in the library.

A typical API call and the code the converter writes for it:

curl https://api.example.com/v1/items \
  -H 'Authorization: Bearer TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"name":"Widget","price":9.5}' -m 10

import requests

headers = {
    'Authorization': 'Bearer TOKEN',
}

json_data = {
    'name': 'Widget',
    'price': 9.5,
}

response = requests.post(
    'https://api.example.com/v1/items',
    headers=headers,
    json=json_data,
    timeout=10,
)
print(response.text)

With json=, requests serializes the dict and sets Content-Type: application/json for you, so that header is dropped from the dict. When the JSON has numbers too large for a float, the converter keeps the body as a string in data= so nothing is rounded. requests has no default timeout, so a request without timeout= can wait forever; add one even when the curl command has no -m. Prefer async code? Pick Python httpx, whose API is almost the same.

fetch is built into browsers and into Node.js 18 and later. In a browser, scripts cannot set forbidden request headers such as Cookie, Host, Content-Length and Accept-Encoding; the browser sets them itself. A cross-origin request also needs the server to allow it with CORS, which curl never checks. That is why a request that works in curl can fail from a web page. For Node.js, pick the Node.js target, which keeps every header.

const response = await fetch('https://api.example.com/v1/items', {
  method: 'POST',
  headers: {
    Authorization: 'Bearer TOKEN',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    name: 'Widget',
    price: 9.5
  }),
  signal: AbortSignal.timeout(10000)
});
const data = await response.text();
console.log(data);

axios sends a plain object as JSON and parses JSON responses on its own, and it rejects the promise on 4xx and 5xx status codes, while fetch only rejects on network errors. To inspect the JSON response, paste it into the JSON formatter.

• -d alone makes a POST with application/x-www-form-urlencoded, even when the data is JSON. Servers that expect JSON then reject it. Add -H 'Content-Type: application/json' or use --json (curl 7.82.0 and later), which also sets Accept.
• -d @file removes newlines from the file. Use --data-binary @file to send it unchanged.
• -X POST with -d is redundant. -X GET with -d sends a GET with a body; use -G to put the data in the query string instead.
• --compressed asks for gzip, deflate or brotli and decompresses the answer. Most libraries do this by default; the code sets it only where needed.
• Query strings must be URL-encoded. Check one with the URL parser, and read a Bearer token with the JWT decoder.