Cheatsheet cURL

curl https://api.example.com

# Save response to a file
curl https://site.com -o page.html

# Follow redirects
curl -L http://site.com

Basic GET request.

# Connection timeout (5s)
curl --connect-timeout 5 url

# Total timeout (30s)
curl --max-time 30 url

# Retry on failure
curl --retry 3 --retry-delay 2 url

Time control.

# Headers only
curl -I https://site.com

# Headers + body
curl -i https://site.com

# Status code only
curl -o /dev/null -s -w "%{http_code}" url

Inspect the response.

# No progress bar
curl -s https://api.com

# Silent but shows errors
curl -sS https://api.com

# Show detailed errors
curl -sS --show-error url

Control the output.

# Directly in the URL
curl "https://api.com/search?q=node&p=2"

# With --data-urlencode
curl -G https://api.com/search
  --data-urlencode "q=hello world"
  --data-urlencode "p=2"

Query strings (GET).

curl -X POST https://api.com/users

# With form data
curl -X POST https://api.com/users
  -d "name=Anna&email=ana@mail.com"

Send a POST request.

# PUT (replace)
curl -X PUT https://api.com/users/1
  -d "name=Anna Silva"

# PATCH (partial update)
curl -X PATCH https://api.com/users/1
  -d "email=new@mail.com"

Update resources.

curl -X DELETE https://api.com/users/1

# With authentication
curl -X DELETE https://api.com/users/1
  -H "Authorization: Bearer TOKEN"

Delete resources.

# Custom method
curl -X OPTIONS https://api.com

# HEAD
curl -I https://api.com

# Any verb
curl -X CUSTOM https://api.com

-X / --request option.

curl https://api.com
  -H "Content-Type: application/json"
  -H "Accept: application/json"
  -H "X-API-Key: abc123"

# Remove a header
curl url -H "User-Agent:"

-H / --header option.

# user:password
curl -u user:password https://api.com

# User only (prompts for password)
curl -u user https://api.com

Basic authentication.

curl https://api.com/private
  -H "Authorization: Bearer YOUR_TOKEN"

Token authentication (JWT/OAuth).

# Custom User-Agent
curl url -A "MeuApp/1.0"

# Referer
curl url -e "https://source.com"

# Cookies via header
curl url -H "Cookie: id=123"

Client identification.

curl -X POST https://api.com/users
  -H "Content-Type: application/json"
  -d '{
    "name": "Anna",
    "email": "ana@mail.com"
  }'

Send a JSON payload.

# Read body from a file
curl -X POST https://api.com/users
  -H "Content-Type: application/json"
  -d @data.json

Use a file the the body.

# multipart/form-data
curl -X POST https://api.com/upload
  -F "name=Anna"
  -F "photo=@photo.jpg"

Form data.

# application/x-www-form-urlencoded
curl -X POST https://api.com/login
  --data-urlencode "user=ana"
  --data-urlencode "pass=a b c"

# -d encodes automatically

Encoded data.

# Original name (uppercase -O)
curl -O https://site.com/photo.jpg

# Custom name
curl -o image.png https://site.com/f

# Several files
curl -O url1 -O url2

Download files.

# Continue transfer (-C -)
curl -C - -O https://site.com/big.zip

Resume interrupted downloads.

# Upload via form
curl -X POST https://api.com/upload
  -F "file=@document.pdf"

# Binary upload (PUT)
curl -X PUT https://api.com/file
  --data-binary @photo.jpg

Send files.

# Download via FTP
curl -u user:pass ftp://server/f.txt

# Upload via FTP
curl -u user:pass -T local.txt
  ftp://server/remote.txt

FTP transfers.

# Connection details
curl -v https://site.com

# Send/receive trace only
curl --trace - https://site.com

# Trace to a file
curl --trace log.txt url

Detailed diagnostics.

# Show request without sending
curl --trace-ascii - url

# Request headers
curl -v url 2>&1 | grep ">"

Inspect the request.

# Variables with -w
curl -s -o /dev/null -w \
  "Status: %{http_code}\n
   Time: %{time_total}s\n
   Size: %{size_download}\n" url

Request metrics.

curl -s -o /dev/null -w \
  "DNS: %{time_namelookup}\n
   Connection: %{time_connect}\n
   TTFB: %{time_starttransfer}\n
   Total: %{time_total}\n" url

Performance analysis.

# Save cookies
curl -c cookies.txt https://site.com

# Send cookies
curl -b cookies.txt https://site.com

# Manual cookie
curl -b "session=abc" url

Cookie management.

# Follow redirects
curl -L http://site.com

# Maximum redirects
curl -L --max-redirs 5 url

# View final destination
curl -L -o /dev/null -w "%{url_effective}" url

Follow redirects.

# Ignore certificate (testing)
curl -k https://self-signed.com

# Specific certificate
curl --cacert cert.pem url

# Force TLS version
curl --tlsv1.2 url

SSL security.

# Use a proxy
curl -x http://proxy:8080 url

# Proxy with authentication
curl -x http://user:pass@proxy:8080 url

# No proxy for a host
curl --noproxy "localhost" url

Connection via proxy.

# Formatted and colored
curl -s https://api.com/users | jq

# Extract a field
curl -s url | jq '.data.name'

# Array of names
curl -s url | jq '.[].name'

Process JSON responses.

• Use -s in scripts (no progress)
• Always -L if there are redirects
• Check %{http_code} in automation
• Use -k only in local tests
• Protect tokens (not in history)
• Prefer --data-urlencode for data

Usage conventions.

# Separate headers
curl -D headers.txt -o body.html url

# Headers only
curl -sI url > headers.txt

Separate headers and body.

# Sequence of URLs
curl "https://api.com/page[1-3]"

# Name pattern
curl -O "https://site.com/img[01-10].png"

URLs in sequence.

# ~/.curlrc
-H "Accept: application/json"
--connect-timeout 10
-L

# Use a specific config
curl --config my.curlrc url

Persistent defaults.