What is the difference between -d and -F in curl?

-d sends a body as application/x-www-form-urlencoded (or raw bytes you supply), while -F sends multipart/form-data, which is what you need for file uploads. Use -F field=@file.png to attach a file and -d for simple form or JSON payloads.

How do I make curl follow redirects?

Add -L (or --location). Without it, curl prints the 3xx response and stops; with it, curl requests the URL in the Location header and keeps going until it reaches a non-redirect response or hits the --max-redirs limit.

How do I see the request and response headers?

Use -v for a verbose trace that shows the request line, sent headers (>), and received headers (<). Use -i to include only the response headers in the printed body, or -D - to dump headers to stdout separately.

Why does curl show no output for a successful POST?

Many APIs return an empty body on success, so curl prints nothing. Add -i to see the status line and headers, or -w "%{http_code}\n" to print just the status code after the transfer.

Is it safe to paste a curl command with a token into an online tool?

Only if the tool runs entirely in your browser and never uploads the command. A real curl command often carries a live bearer token or password, so strip or rotate secrets first and prefer client-side converters.

A cURL Command Cheat Sheet for Developers

Q: Why does curl show no output for a successful POST?

Many APIs return an empty body on success, so curl prints nothing. Add -i to see the status line and headers, or -w "%{http_code}\n" to print just the status code after the transfer.

Q: Is it safe to paste a curl command with a token into an online tool?

Only if the tool runs entirely in your browser and never uploads the command. A real curl command often carries a live bearer token or password, so strip or rotate secrets first and prefer client-side converters.

You can cover almost every day-to-day HTTP task with about a dozen curl flags: -X for the method, -H for headers, -d or -F for the body, -u for auth, -L to follow redirects, -o/-O to save output, and -v/-i to see what actually happened. curl has hundreds of options, but the working set is small and stable. This cheat sheet groups the flags you will reach for constantly, shows a worked example of each, and points out the quiet defaults — the implicit POST, the silent redirect stop — that catch people out.

Which curl flags do you actually need?

Start with the core set, because these cover the four parts of any request — method, headers, body, and auth — plus the handful of options that control output and debugging. Everything else is a refinement of these.

Flag	Long form	What it does
`-X`	`--request`	Set the HTTP method (GET, POST, PUT, DELETE, PATCH)
`-H`	`--header`	Add one request header; repeat for more
`-d`	`--data`	Send a request body; implicitly switches to POST
`-F`	`--form`	Send multipart/form-data, including file uploads
`-u`	`--user`	HTTP Basic auth as `user:password`
`-L`	`--location`	Follow 3xx redirects to the `Location` URL
`-o`	`--output`	Write the body to a named file
`-O`	`--remote-name`	Save using the remote filename from the URL
`-i`	`--include`	Include response headers in the output
`-v`	`--verbose`	Print a full trace of the request and response
`-s`	`--silent`	Suppress the progress meter and error messages
`-w`	`--write-out`	Print custom variables (status, timing) after the transfer

A plain GET needs none of these — curl https://api.example.com/health is a complete command. The flags exist to shape the request when the default GET-with-no-body is not what you want.

How do you send headers and a JSON body?

Repeat -H for each header and pass the body with -d, but set the content type yourself. curl does not assume your body is JSON; if you send JSON with -d and omit the header, curl labels it application/x-www-form-urlencoded, and a strict API will reject it. A correct JSON POST looks like this:

curl -X POST https://api.example.com/v1/orders 
  -H "Content-Type: application/json" 
  -H "Authorization: Bearer TOKEN" 
  -d '{"sku":"AB-12","qty":3}'

Two details matter here. First, the single quotes around the JSON belong to your shell, not to curl — they stop the shell from interpreting the braces and quotes inside. Second, -d strips newlines and treats a leading @ as “read from a file”. If you want multi-line JSON sent verbatim, use --data-raw, which disables both behaviours. To read a body from a file deliberately, use -d @payload.json.

For form submissions, drop the content-type header and let curl default it: curl -d "name=Ada&role=admin" https://example.com/login sends URL-encoded form data. To be safe with special characters, use --data-urlencode "name=Ada Lovelace", which encodes the value for you.

How do you upload a file?

Use -F, which switches curl to multipart/form-data and lets you attach files with the @ prefix. Each -F is one form field:

curl -X POST https://example.com/upload 
  -F "title=Vacation photo" 
  -F "image=@/home/ada/beach.png"

curl sets the multipart boundary and per-part headers automatically, and it guesses the content type of the file from its extension. To override that guess, append ;type=, as in -F "image=@beach.png;type=image/png". Do not mix -d and -F in the same command — they describe two different body encodings, and curl will use the form encoding.

How do you handle auth, redirects, and cookies?

Reach for -u for Basic auth, -L for redirects, and -b/-c for cookies. -u user:pass is a shortcut: it base64-encodes user:password and sends it as Authorization: Basic <encoded>. For token auth you skip -u and set the header directly with -H "Authorization: Bearer TOKEN".

Redirects are the classic surprise. By default curl prints the 3xx response and stops — it does not follow the Location header. Add -L to follow it, and combine with --max-redirs 5 to cap the chain. This is why a URL that works in a browser can appear to “return nothing useful” in curl: the browser followed the redirect and curl did not.

For sessions that depend on cookies, save them on the first request and send them on the next:

curl -c jar.txt -d "user=ada&pass=secret" https://example.com/login
curl -b jar.txt https://example.com/dashboard

-c writes received cookies to a file; -b reads them back. You can also pass cookies inline with -b "session=abc123".

How do you save output and inspect what happened?

Use -o or -O to save a body, and -i, -v, or -w to see the metadata. -o report.json writes to a name you choose; -O reuses the filename from the URL, so curl -O https://example.com/files/report.json saves report.json. Add -L when downloading, because many download URLs redirect to a CDN.

When a request misbehaves, the fastest diagnosis is -v. It prints the request line, the headers curl sent (marked >), and the headers it received (marked <), so you can confirm the method, the content type, and the status code in one view. If you only want the response headers alongside the body, -i is lighter. And to script health checks, -w prints exactly the fields you name:

curl -s -o /dev/null -w "%{http_code} %{time_total}sn" https://api.example.com/health

That command discards the body (-o /dev/null), stays quiet (-s), and prints just the status code and total time — a compact probe you can drop into a loop.

Which defaults trip people up?

The recurring gotcha is that -d quietly makes the request a POST. The moment a body is present, curl changes the method from GET to POST unless you override it with -X. People copy a command that has -d but no -X POST, assume it is a GET because they never see the word POST, and then reproduce it wrongly in code. It is a POST. A second gotcha is the missing content type described earlier; a third is forgetting -L and concluding an endpoint is broken when it merely redirected.

One more habit worth building: treat the command itself as a secret when it carries auth. A curl command with -H "Authorization: Bearer …" or -u user:pass contains a live credential. Do not paste it into chat logs, tickets, or a server-side “curl converter” that uploads your command to convert it. When you need to turn a command into fetch, requests, or Go, our cURL-to-code converter runs entirely in your browser, so the command — and the token inside it — never leaves your machine. Strip or rotate any live credential before you share a command anywhere.

A one-line summary to keep nearby

Method with -X, headers with -H, body with -d or -F, auth with -u or an Authorization header, follow redirects with -L, save with -o/-O, and debug with -v or -w. Remember that -d implies POST, that JSON needs an explicit content type, and that curl does not follow redirects on its own. Those three facts prevent most of the confusion, and the rest of the cheat sheet is just knowing which flag names the thing you already want to do.