cURL Command Reference Cheat Sheet
A quick reference for common curl flags covering HTTP methods, headers, authentication, file transfer, and debugging output.
1 PageBeginnerFeb 18, 2026
Basic Requests
Sending common HTTP methods.
bash
curl https://api.example.com/users # GET requestcurl -X POST https://api.example.com/users # POST requestcurl -X PUT https://api.example.com/users/1 # PUT requestcurl -X DELETE https://api.example.com/users/1 # DELETE requestcurl -I https://api.example.com # HEAD request (headers only)
Headers & Data
Sending JSON payloads and custom headers.
bash
curl -X POST https://api.example.com/users \ -H "Content-Type: application/json" \ -H "Authorization: Bearer TOKEN" \ -d '{"name": "Alice", "age": 30}'curl -G https://api.example.com/search \ --data-urlencode "q=hello world" # URL-encode query params
Files & Output Control
Downloading, uploading, and formatting output.
bash
curl -O https://example.com/file.zip # save with remote filenamecurl -o out.zip https://example.com/file.zip # save with custom namecurl -F "[email protected]" https://api.example.com/upload # multipart uploadcurl -L https://example.com/redirect # follow redirectscurl -s -o /dev/null -w "%{http_code}\n" https://example.com # status code only
Useful Flags
Frequently used options for debugging and control.
- -v / --verbose- Show request/response headers and connection details
- -s / --silent- Suppress progress meter and error messages
- -i / --include- Include response headers in the output
- -k / --insecure- Skip TLS certificate verification (use only for local/dev testing)
- -u user:pass- Send HTTP basic authentication credentials
- --retry N- Retry the request N times on transient failure
- -c / -b- Save cookies to a file (`-c`) / send cookies from a file (`-b`)
Advanced --write-out Formatting
Extract precise timing and connection metrics for performance diagnostics.
bash
curl -s -o /dev/null -w "\dns_lookup: %{time_namelookup}s\n\tcp_connect: %{time_connect}s\n\tls_handshake: %{time_appconnect}s\n\ttfb: %{time_starttransfer}s\n\total: %{time_total}s\n\http_code: %{http_code}\n\size_download: %{size_download} bytes\n" \ https://api.example.com/health# Reusable format file: curl -w "@format.txt" -o /dev/null -s URL# format.txt contents:# Connect: %{time_connect} TTFB: %{time_starttransfer} Total: %{time_total}\n
Retries, Timeouts & Resumable Transfers
Build resilient calls for flaky networks and large file transfers.
bash
# Retry with exponential backoff, only on transient errors (not 4xx)curl --retry 5 --retry-delay 2 --retry-max-time 60 \ --retry-connrefused \ https://api.example.com/orders# Hard timeouts: fail fast instead of hangingcurl --connect-timeout 5 --max-time 15 https://api.example.com# Resume an interrupted download from where it left offcurl -C - -O https://example.com/large-dataset.tar.gz# Rate-limit bandwidth usagecurl --limit-rate 200K -O https://example.com/file.zip
Parallel Requests & Config Files
Fire multiple requests concurrently and externalize repeated flags.
bash
# curl 7.66+: run requests in parallelcurl --parallel --parallel-immediate \ -Z https://api.example.com/a https://api.example.com/b# Reusable config file (avoids giant one-liners)# curlrc.txt:# header = "Authorization: Bearer TOKEN"# header = "Content-Type: application/json"# silentcurl -K curlrc.txt https://api.example.com/users# Loop templated URLs (globbing)curl "https://api.example.com/users/[1-5]" # sequential IDscurl "https://api.example.com/{orders,invoices}" # multiple paths
TLS Inspection & Client Certificates
Debug certificate chains and authenticate with mutual TLS.
bash
# Print the full TLS handshake and certificate chaincurl -v --cacert ca-bundle.pem https://api.example.com 2>&1 | grep -A5 "Server certificate"# Pin to a specific TLS version (debugging legacy servers)curl --tlsv1.2 --tls-max 1.2 https://legacy.example.com# Mutual TLS (mTLS) with client cert + keycurl --cert client.pem --key client-key.pem \ --cacert ca.pem https://secure.example.com# Inspect just the certificate expiry/subjectcurl -vI https://example.com 2>&1 | grep -E "subject:|expire"
Protocol & Connection Control
Flags that control HTTP version, connection reuse, and low-level behavior.
- --http2- Force HTTP/2 for the request (falls back to 1.1 if the server doesn't support it)
- --http3- Use HTTP/3 (QUIC) where curl and the target both support it
- -6 / -4- Force IPv6 or IPv4 resolution when a host has both
- --resolve host:port:ip- Override DNS resolution for a host, useful for testing before a DNS cutover
- -e / --referer- Set the Referer header, or use `;auto` to follow it automatically on redirects
- --compressed- Request a compressed response (gzip/br) and auto-decompress it
- --unix-socket- Send the request over a Unix domain socket instead of TCP, e.g. the Docker daemon API
Pro Tip
Use `curl -w "@format.txt"` with a custom format file (or inline `-w "%{time_total}\n"`) to capture precise timing metrics like DNS lookup and TTFB when diagnosing slow API calls.
Was this cheat sheet helpful?
Explore Topics
#CURLCommandReference#CURLCommandReferenceCheatSheet#ToolsOthers#Beginner#BasicRequests#HeadersData#FilesOutputControl#UsefulFlags#Functions#Networking#Security#CheatSheet#SkillVeris
