About cURL Cheatsheet

HTTP from the CLI — methods, headers, auth, timing, retries. Part of the DevTools Surf developer suite. Browse more tools in the Cheatsheets collection.

Use Cases

• Backend devs testing REST endpoints without leaving the terminal
• QA engineers scripting automated API smoke tests in CI pipelines
• DevOps teams debugging webhook payloads with verbose output
• Security researchers inspecting HTTP headers and TLS handshakes

Tips

• Use the timing flags section to debug slow API responses
• Copy the auth header examples for Bearer and Basic patterns
• Check the retry and redirect options for resilient scripts

Fun Facts

• cURL was first released by Daniel Stenberg in 1998; the name stands for 'Client URL.' Stenberg still maintains it as of 2024.
• cURL supports over 25 protocols including HTTP, FTP, SMTP, LDAP, and even Gopher — a pre-web protocol from 1991.
• The cURL project has received over 300 CVE security reports since its creation, making it one of the most audited open-source tools in history.

FAQ

Does it cover newer flags like --http3?

Yes. HTTP/3, Early Data, and Connection reuse flags are documented. cURL supports these from version 7.66+.

What about authentication examples?

Basic, Bearer, Digest, NTLM, and OAuth examples included. Plus netrc and --anyauth for libraries that need it.

Is it just GET and POST?

All HTTP methods. Plus multipart uploads, cookies, and redirect handling.

Does it show session management?

Yes — -b for sending cookies, -c for saving them. Useful when working with login-required APIs.