Curl Cheat Sheet: Essential Flags and Options Reference

What Is Curl?

Curl (short for "Client URL") is a command-line tool for transferring data using various network protocols. It ships with virtually every Unix-based operating system and is the de facto standard for making HTTP requests from the terminal. Whether you're debugging an API, testing a webhook, or automating a deployment script, curl is likely your first tool.

Despite its power, curl's flag system can be opaque. The tool accepts over 200 options, and most developers use only a handful regularly. This cheat sheet covers the flags you'll actually use day to day, with real-world examples you can paste directly into your terminal.

HTTP Methods

The -X flag (or --request) sets the HTTP method. If omitted, curl defaults to GET. When -d (data) is provided without -X, curl automatically switches to POST.

# GET request (default)
curl https://api.example.com/users

# Explicit POST
curl -X POST https://api.example.com/users

# PUT to update a resource
curl -X PUT https://api.example.com/users/42

# PATCH for partial updates
curl -X PATCH https://api.example.com/users/42

# DELETE a resource
curl -X DELETE https://api.example.com/users/42

Setting Headers

The -H flag (or --header) adds a custom header to the request. You can use it multiple times to add several headers. The header value follows a colon-space separator.

# Set Content-Type for JSON
curl -H "Content-Type: application/json" https://api.example.com

# Multiple headers
curl -H "Content-Type: application/json" \
     -H "Accept: application/json" \
     -H "X-Request-Id: abc-123" \
     https://api.example.com

Sending Data

The -d flag sends data in the request body. Variants include --data-raw(no special character interpretation), --data-binary (preserves newlines), and--data-urlencode (URL-encodes the value).

# JSON body
curl -X POST \
  -H "Content-Type: application/json" \
  -d '{"name": "Alice", "email": "alice@example.com"}' \
  https://api.example.com/users

# Form-encoded data
curl -X POST \
  -d "username=admin&password=secret" \
  https://api.example.com/login

# Data from a file
curl -X POST \
  -H "Content-Type: application/json" \
  -d @payload.json \
  https://api.example.com/users

Authentication

Curl supports multiple authentication methods. The -u flag handles Basic auth by encoding the credentials as Base64 in the Authorization header. For Bearer tokens and API keys, use the -H flag directly.

# Basic auth
curl -u admin:password https://api.example.com/protected

# Bearer token
curl -H "Authorization: Bearer eyJhbGciOiJIUzI1NiJ9..." \
  https://api.example.com/me

# API key in custom header
curl -H "X-API-Key: your-api-key-here" \
  https://api.example.com/data

Cookies

The -b flag sends cookies with the request. You can pass cookie values directly or read them from a file previously saved with -c.

# Send cookies inline
curl -b "session=abc123; theme=dark" https://example.com

# Save cookies to a file
curl -c cookies.txt https://example.com/login

# Read cookies from a file
curl -b cookies.txt https://example.com/dashboard

Other Useful Flags

# Follow redirects
curl -L https://example.com/old-page

# Show response headers
curl -i https://api.example.com

# Verbose output (debug)
curl -v https://api.example.com

# Silent mode (no progress bar)
curl -s https://api.example.com

# Set connection timeout
curl --connect-timeout 5 https://api.example.com

# Set max request time
curl --max-time 30 https://api.example.com

# Skip SSL verification (development only!)
curl -k https://self-signed.example.com

Combining Flags

In practice, curl commands combine many flags. Here's a realistic example that you might find in API documentation or Slack channels:

curl -s -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer ${API_TOKEN}" \
  -d '{
    "name": "New Project",
    "description": "Created via API",
    "visibility": "private"
  }' \
  https://api.example.com/projects

You can paste this kind of command directly into the API Playground to parse it, execute it, and generate code in Python, JavaScript, Go, and more.

Try It Yourself

Copy any curl command from your terminal or documentation and paste it into the API Playground's Curl Import. It automatically extracts the method, URL, headers, body, and authentication — then lets you modify, execute, and export to code in 7 languages.