cURL Converter: Convert cURL to Python, JavaScript, Go and PHP

A cURL command is how most API documentation, bug reports and browser network tabs show an HTTP request. A program needs the same request as code. This converter reads a curl command and writes it as JavaScript fetch, Node.js axios, Python requests, Go net/http or PHP, with the method, URL, headers, body, login and cookies carried over.

import requests

response = requests.post(
    "https://api.example.com/cats",
    headers={
        "Content-Type": "application/json",
        "Authorization": "Bearer YOUR_TOKEN",
    },
    json={
        "name": "Mittens",
        "age": 3,
    },
    allow_redirects=False,
)

print(response.status_code)
print(response.text)

The command is only read, never run. Nothing you paste is uploaded and the URL is never fetched, so it is safe to try with a request from a private API. Swap real tokens for placeholders before you share the code, though.

How to use it

1. Paste a cURL command in the top box. A command that runs over several lines, with a backslash at the end of each, is fine.
2. Pick the language under Convert to.
3. Read the line above the code, which says how the command was understood, for example Read as POST https://api.example.com/cats.
4. Check Not converted and Ignored if they appear. Every flag the tool saw is in one of the two lists, or in the code.
5. Tap Copy and paste the code into your project.

Copying a request from your browser

The quickest way to get a cURL command for a request is the browser itself.

1. Open DevTools and go to the Network tab.
2. Reload the page or trigger the request, then right-click it in the list.
3. Choose Copy, then Copy as cURL (bash). On Windows, Copy as cURL (cmd) writes the version for the command prompt.
4. Paste it here.

Both formats work. The bash one quotes a body with a newline or a non-ASCII character as $'...', and the cmd one escapes with ^ and ends each line with ^. The tool reads both, and says Windows cmd syntax above the box when it detects the second.

Browsers add a lot of headers (sec-ch-ua, accept-language, sec-fetch-mode). They are all converted, because the converter cannot know which ones the server needs. Delete the ones you do not need from the code.

What is converted

Flags can be combined (-sSL), attached to their value (-XPOST, -H'X-Id: 7') or joined with an equals sign (--header='X-Id: 7'). The URL can come before, between or after them. A URL with no http:// gets one, as in curl.

What is listed instead of converted

A converter that quietly drops a flag gives you code that behaves differently from the command, and nothing tells you. This one never does that.

• Ignored are flags that do not change the request: -s, -S, -v, -i, -f, -o file, -O, -w, timeouts and retries, and the HTTP version flags. Anything after a pipe, a ;, a && or a > is ignored too, because the shell runs it after curl.
• Not converted are flags that do change the request and have no equivalent here: a proxy (-x), client certificates (--cert), a CA bundle (--cacert), digest and NTLM authentication, DNS overrides (--resolve), a body read from a file (-d @file), a cookie file, a second URL, and any option the tool does not know. Each one is shown with its value and the reason.
• Warnings cover what is not a flag, such as a $TOKEN that the shell would have filled in and the tool keeps as text.

Each language

The PHP code uses the curl extension, which most installs include and which mirrors curl option for option. Guzzle or Symfony HttpClient would do the same job, but need Composer, so the extension is the one that works everywhere.

A JSON body is written as a native object (a dictionary in Python, an object literal in JavaScript) only when that sends the same data. Large integers, numbers like 1.0, escaped characters and keys that would reorder do not survive the trip through an object, so those bodies stay as the exact string curl sent. Strings are quoted by each language's own rules, so quotes, backslashes, newlines and non-ASCII text in a body come out as a literal that means the same thing.

Common gotchas

• Shell quoting is not part of the request. curl -H "Authorization: Bearer $TOKEN" has the shell fill in $TOKEN. The tool cannot, so it keeps the text and warns you. Replace it with the real value, or read it from an environment variable in your code.
• -d is not JSON. -d '{"a":1}' sends the form content type unless a Content-Type: application/json header is set, and many APIs reject that. Use --json, or add the header.
• -G is not a body. curl -G -d q=cats sends GET /search?q=cats, with the data in the query string and no body. Without -G, -d makes a POST.
• Browsers will not let fetch set every header. Cookie, Host, Origin, Referer and Accept-Encoding are ignored in a browser and sent as written in Node.js. The converted code notes it when the command has one.
• fetch cannot send a body with GET or HEAD. curl can. The converted code has a comment when the command does.
• Redirects differ. See the table above. The converter copies what curl did, so a command without -L gives code that stops at the 301.
• A file path is the path on the machine that ran curl. -F file=@photo.png becomes code that opens photo.png. Change it to where the file lives.
• Do not paste live secrets into any website. This one never sends them anywhere, but a pasted token also ends up in your clipboard history and your shell history. Rotate a token that has been through either.

Related

• The HTTP Status Codes reference for what the response to your request means, from 201 to 429 to 502.
• JSON Formatter to tidy the response body, and Base64 Encoder and Decoder to read the credentials in an Authorization: Basic header.
• Regex Tester and Unix Timestamp Converter for the other jobs that come up while you debug an API.
• The Bash cheat sheet for the quoting and continuation rules a cURL command is written in, and the cheat sheets for JavaScript, Python, Go and PHP.

Common questions