curl Cheat Sheet

Fetch a URL and print the body to stdout.

-L follow redirects; -i include headers; -I HEAD only; -v verbose; -s silent; -S show errors; --compressed decode gzip/brotli

Download a file: -O keeps the remote name, -o writes to a chosen path.

-O; -o file; --create-dirs; --remove-on-error; -C - resume; --retry N; --retry-delay N

Force a specific HTTP method (POST/PUT/PATCH/DELETE...).

-X POST/PUT/PATCH/DELETE; --request-method; --request-target

Send one or more custom headers (Content-Type, X-API-Key, etc.).

-H 'X-API-Key: ...'; -H repeated; --json (Content-Type + payload); --form -F (multipart)

Set the User-Agent string or Referer.

-A 'Mozilla/5.0 ...'; -e 'https://google.com'; --referer alias

-i shows headers inline; -D writes them to a file; -I sends HEAD only.

-i; -D <file>; -I; --dump-header <file>

HTTP Basic auth (with optional password; leave out the colon for prompt).

-u user:pass; --basic; -U readonly specific method

Send a Bearer token (also works via --oauth2-bearer).

--oauth2-bearer $TOKEN; --bearer alias (8+)

Use client certificates / CA bundle for mTLS.

--cert certfile[:password]; --key key; --cacert ca.pem; --capath dir

Send a request body (POST/PUT). -d defaults to form encoding; --data-binary preserves bytes.

-d 'a=b&c=d'; --data-raw; --data-binary @f; -G with --data-urlencode builds a query string

Send a multipart/form-data upload (the browser's standard upload format).

-F field=value; -F file=@path; -F '[email protected];type=image/png'; --form-string raw

Build a URL-encoded query string (URL-encode values automatically).

-G --data-urlencode 'q=hello world' --data-urlencode 'limit=10'

Send JSON in the request body.

use --json shortcut (Content-Type + payload in one flag)

Pipe response into jq for readable / filtered JSON.

jq '. | {name,id}'; jq 'select(.id==42)'

Read cookies (b) / write cookies (c). Pass -j on first call to capture redirects.

-c jar.txt save; -b "k=v" literal; -b / -c /tmp/jar same file

Long-form aliases of -c / -b; use these in scripts for clarity.

Verbose handshake trace; --trace dumps bytes sent/received.

-v / -vv / -vvv; --trace-ascii file; --trace file (binary)

Reset flags between chained requests (avoids 'URL parm 0' and connection leaks).

--next; provides a per-call reset

Define a write-out template — useful in scripts to inspect timing or status.

-w 'status=%{http_code} time=%{time_total}\n'; --write-out

Resume a partial download from where it stopped.

-C -; --continue-at -

Auto-retry transient errors (network, 5xx, reset).

--retry; --retry-delay; --retry-max-time; --retry-connrefused; --retry-all-errors (8+)

Cap the bandwidth usage or absolute run time.

--limit-rate 200k; --max-time 30; --connect-timeout 5

Upload a file via PUT (or HTTP PUT/RESUMABLE, with -C -).

-T file; --upload-file; continue -C -; combine with -H 'Authorization: ...'

Bind a NIC (use a VPN interface IP) or override DNS — for split DNS debugging.

--interface eth0:0; --dns-servers 1.1.1.1; --resolve 'host:port:ip' overrides per-call

Negotiate a specific protocol or TLS version.

--http2; --http2-prior-knowledge; --http3 (curl ≥ 7.88); --tls-max 1.3; --no-alpn

Skip or override TLS verification (insecure = debug only).

-k / --insecure; --cacert ca.pem; --capath dir

Drive curl from a config file — great for repeatable scripts.

--config file; per-call options

Run multiple URLs concurrently from a single curl instance (curl 7.68+).

--parallel; --parallel-immediate; --parallel-max N

Common URL-getting idiom for scripts: silent, follow, fail on HTTP errors, output.

-f / --fail; --fail-with-body show body on error; -s silent; -L follow; -S show errors

Request gzip, deflate, or brotli with --compressed; saves bandwidth.

--compressed