How do I convert a curl command to Python requests?

Paste the command in the box and choose Python. The code sets url, a headers dictionary and data or files, then calls requests.get, requests.post or the function for the command's method (requests.request for a method such as PURGE), adding timeout= for -m, verify=False for -k and auth= for -u when the user name and password are plain ASCII. A body or header value with characters outside ASCII is written with .encode("utf-8"), so requests sends the same UTF-8 bytes curl sends.

Why does -d turn my request into a POST?

Because curl does that: -d, --data, --data-ascii, --data-raw, --data-binary, --data-urlencode and --json all send a body, and a body means POST unless -X names another method, such as -X PUT. With -G the same data goes into the URL's query instead and the method stays GET. When a body goes out and the command sets no Content-Type, the code writes the one curl would send: application/x-www-form-urlencoded, or application/json with Accept: application/json for --json.

What happens to $( ), backticks, variables and @file in my command?

Each one is an error, listed with its line and column, and no code is made until they are gone. The page never runs a shell and never reads a file from your disk, so it cannot know what $(cat token.txt), a backtick command, $TOKEN or -d @body.json would have produced. Replace each with the value itself; --data-raw is the one data flag that sends a leading @ as written.

Is a command with my API key or password stored or sent anywhere?

No. The conversion runs in this tab, and the command is never saved, sent or added to analytics. The only thing the page remembers is which language you picked. The code it gives you does hold whatever credentials the command held, such as an Authorization header, a cookie or the -u password written as Basic auth, because the request needs them.

Does it read Copy as cURL from Chrome or Firefox?

The bash version, yes: -H, -b, --data-raw, --compressed and $'...' strings all convert, including the \n, \u and \x escapes inside $'...'. The Windows cmd version, with ^" quoting and lines that end in ^, is named as an error, and the message points to Copy as cURL (bash) instead.

Which curl flags does it convert?

The URL, as an argument or with --url, and -X, -H, -d, --data, --data-ascii, --data-raw, --data-binary, --data-urlencode, --json, -F and --form-string text fields, -G, -I, -u, --basic, --oauth2-bearer, -A, -e, -b, -m, -L, -k, --compressed and -g. Fetch has no way to skip certificate checks, so -k is an error there and converts for Axios and requests. Flags that change only curl's own output, meaning what it prints, the files it saves or its exit status, such as -s, -v, -i, -o, -w and --fail, are listed as ignored. Every other flag, from -x for a proxy to --http2, is an error that names it.

Why does the Fetch code not send my Cookie header from a web page?

Browsers keep some headers for themselves, among them Cookie, Host, Origin, Referer and Content-Length, and fetch or Axios running in a web page leaves them out. The code still carries them, and outside a browser, in Node for example, a Cookie header is sent as written. When the command sets one of them, the notes under the command name it.

Curl to Code Converter

Paste a curl command and get the same request as JavaScript Fetch, Axios or Python requests code, converted as text and never run. What is different here is how strictly the command is read: it is split into words the way a shell splits it, with single quotes, double quotes, backslash line breaks and the $'...' strings that Copy as cURL writes, and anything that would need a shell or your disk, such as $( ), backticks, a variable or a -d @file reference, is named as an error with its line and column instead of being guessed at or read. A flag the page does not convert is named too, never dropped.

curl command (example)example, 173 bytes of 64 KB

method    POST, set by -d
url       https://api.example.com/v1/notes
headers   2
  Content-Type: application/json
  X-Request-Label: weekly report draft
body      38 bytes
errors    none: no unsupported flags
notes
  - Without -L curl stops at a redirect, and this code follows it, as fetch does by default.

JavaScript Fetch

const response = await fetch("https://api.example.com/v1/notes", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "X-Request-Label": "weekly report draft"
  },
  body: "{\"title\":\"Weekly report\",\"done\":false}"
});

converted as text: nothing is run, read from disk or sent

Method

POST, from -d

Headers

Body

38 bytes

Code

JavaScript Fetch

The command is converted in this tab. It is never saved, sent or added to analytics, and that matters because a pasted command often carries an Authorization header, a -u password or a session cookie. The page remembers only the language you picked, and Start over above the tool forgets it.

Examples

-H 'X-Request-Label: weekly report draft'a quoted header with spaces
one header, X-Request-Label: weekly report draft
-X PUT with -d 'qty=3'an explicit method and data
method PUT, body qty=3; without -X the same -d would be POST
$(cat token.txt), a backtick, or -d @body.jsonshell interpolation or a file reference
3 problems flagged and not converted: nothing is run or read

What each flag becomes

curl flag	In the code
-X, --request	the method, as written
-H, --header	a header; 'Name;' sends it with an empty value
-d, --data, --data-ascii	the body and POST, with curl's form Content-Type when none is set; @file is refused
--data-raw	the body, with a leading @ sent as written
--data-binary	the body as written; @file is refused
--data-urlencode	a percent-encoded part; name=value encodes only the value
--json	the body, with JSON Content-Type and Accept headers
-F, --form-string	text fields of a multipart form; file parts are refused
-G, --get	the data moved into the URL's query
-I, --head	a HEAD request
-u, --user	Basic auth: a header in JavaScript, and auth= in requests when the name and password are ASCII
--oauth2-bearer	an Authorization: Bearer header
-A, -e, -b	User-Agent, Referer and Cookie headers; -b with a file name is refused
-m, --max-time	a timeout in each library's own terms
-L, --location	redirects followed, the libraries' default, with allow_redirects=True for a HEAD request in requests
-k, --insecure	verify=False in requests, an https.Agent in Axios; an error for Fetch
--compressed	nothing extra: the libraries ask for compressed responses by default
-s, -S, -v, -i, -o, -w, --fail	listed as ignored: they change only curl's own output
-x, --proxy and any other flag	an error that names the flag

Accuracy. Converts the text of one curl command, up to 64 KB, and never runs shell interpolation, reads a local file or sends the request, so $( ), backticks, variables and @file references are errors. Flags it does not convert are named as errors too, apart from flags that change only curl's own output, such as -s, -o and --fail, which are listed as ignored. The code carries the method, URL, body and every header the command sets, with -d meaning POST unless -X names another method, escaped for the chosen language.

Common questions

How do I convert a curl command to Python requests?: Paste the command in the box and choose Python. The code sets url, a headers dictionary and data or files, then calls requests.get, requests.post or the function for the command's method (requests.request for a method such as PURGE), adding timeout= for -m, verify=False for -k and auth= for -u when the user name and password are plain ASCII. A body or header value with characters outside ASCII is written with .encode("utf-8"), so requests sends the same UTF-8 bytes curl sends.
Why does -d turn my request into a POST?: Because curl does that: -d, --data, --data-ascii, --data-raw, --data-binary, --data-urlencode and --json all send a body, and a body means POST unless -X names another method, such as -X PUT. With -G the same data goes into the URL's query instead and the method stays GET. When a body goes out and the command sets no Content-Type, the code writes the one curl would send: application/x-www-form-urlencoded, or application/json with Accept: application/json for --json.
What happens to $( ), backticks, variables and @file in my command?: Each one is an error, listed with its line and column, and no code is made until they are gone. The page never runs a shell and never reads a file from your disk, so it cannot know what $(cat token.txt), a backtick command, $TOKEN or -d @body.json would have produced. Replace each with the value itself; --data-raw is the one data flag that sends a leading @ as written.
Is a command with my API key or password stored or sent anywhere?: No. The conversion runs in this tab, and the command is never saved, sent or added to analytics. The only thing the page remembers is which language you picked. The code it gives you does hold whatever credentials the command held, such as an Authorization header, a cookie or the -u password written as Basic auth, because the request needs them.
Does it read Copy as cURL from Chrome or Firefox?: The bash version, yes: -H, -b, --data-raw, --compressed and $'...' strings all convert, including the \n, \u and \x escapes inside $'...'. The Windows cmd version, with ^" quoting and lines that end in ^, is named as an error, and the message points to Copy as cURL (bash) instead.
Which curl flags does it convert?: The URL, as an argument or with --url, and -X, -H, -d, --data, --data-ascii, --data-raw, --data-binary, --data-urlencode, --json, -F and --form-string text fields, -G, -I, -u, --basic, --oauth2-bearer, -A, -e, -b, -m, -L, -k, --compressed and -g. Fetch has no way to skip certificate checks, so -k is an error there and converts for Axios and requests. Flags that change only curl's own output, meaning what it prints, the files it saves or its exit status, such as -s, -v, -i, -o, -w and --fail, are listed as ignored. Every other flag, from -x for a proxy to --http2, is an error that names it.
Why does the Fetch code not send my Cookie header from a web page?: Browsers keep some headers for themselves, among them Cookie, Host, Origin, Referer and Content-Length, and fetch or Axios running in a web page leaves them out. The code still carries them, and outside a browser, in Node for example, a Cookie header is sent as written. When the command sets one of them, the notes under the command name it.

Converts the text of one curl command, up to 64 KB, and never runs shell interpolation, reads a local file or sends the request, so $( ), backticks, variables and @file references are errors. Flags it does not convert are named as errors too, apart from flags that change only curl's own output, such as -s, -o and --fail, which are listed as ignored. The code carries the method, URL, body and every header the command sets, with -d meaning POST unless -X names another method, escaped for the chosen language.