Web & APIs · 4 min read
From curl to Code: Translating HTTP Requests
API documentation and browser dev tools both speak curl. Sooner or later you need that same request in your own code. Once you know how each curl flag maps to an HTTP concept, translating is mechanical.
Try it yourself with the related tool.
Convert curl to code →Advertisement
The flags that matter
-X sets the method. -H adds a header. -d or --data sends a body, and also switches the method to POST when no -X is given. --json sends a JSON body with the right headers. -u user:pass adds Basic authentication. -F builds a multipart form, typically for file uploads. -L follows redirects and -k skips certificate checks.
Mapping to fetch and requests
In JavaScript, the method, headers, and body become the options object of fetch(url, { method, headers, body }). In Python, requests.post(url, headers=..., json=...) covers most cases. One difference catches many people: fetch does not throw on a 404 or 500 — you must check response.ok yourself.
Subtleties when translating
curl does not follow redirects unless you pass -L, while fetch and requests follow them by default. A -d body is sent as application/x-www-form-urlencoded unless you set a Content-Type, so a JSON string sent with -d may need an explicit header. And "Copy as cURL" from dev tools includes cookies and session headers — strip them before sharing.
Never keep -k
The -k flag disables TLS verification. It is sometimes used to reach a local server with a self-signed certificate, but translating it into production code — verify=False or a custom agent that ignores certificates — opens the door to man-in-the-middle attacks. Fix the certificate instead.