How to Convert a curl Command to JavaScript fetch()

A curl command maps almost one-to-one onto a JavaScript fetch() call: -X sets the method, each -H becomes an entry in the headers object, and -d becomes the body — with the method defaulting to POST whenever a body is present. Once you know that mapping, translating the curl snippets in API docs (or your browser’s “Copy as cURL”) into fetch() is mechanical. Paste one into the curl to fetch converter and it does the translation in your browser, so any tokens in the command stay on your machine.

The core mapping

curl flag	fetch equivalent
-X POST / --request POST	method: "POST"
-H "Name: value"	an entry in headers: { … }
-d '…' / --data '…'	body: "…" (and implies POST)
-u user:pass	Authorization: Basic <base64> header
the URL	first argument to fetch()
(no -X, but has -d)	method: "POST"
(no -X, no -d)	method: "GET"

Everything else in a typical command — -L, --compressed, -s, -k — is about how curl itself behaves and has no bearing on the request fetch() makes, so it’s dropped.

A worked example

Take a command straight from an API doc:

curl -X POST https://api.example.com/login \
  -H "Content-Type: application/json" \
  -d '{"user":"ada","pass":"secret"}'

Applying the mapping gives:

fetch("https://api.example.com/login", {
  method: "POST",
  headers: {
    "Content-Type": "application/json"
  },
  body: "{\"user\":\"ada\",\"pass\":\"secret\"}"
})
  .then((res) => res.json())
  .then(console.log);

The URL moves to the first argument, the header becomes a headers entry, and the -d payload becomes the body string. Note that the JSON body stays a string — fetch() does not serialise objects for you, so the double quotes inside the payload are escaped rather than replaced with a JavaScript object literal. If you would rather pass an object, you wrap it yourself with body: JSON.stringify({ user: "ada", pass: "secret" }), which produces the same bytes on the wire.

→ → → →

fetch() method: "POST" headers: { … } body: "{ … }" fetch("https://api…")

A second example: authenticated GET

Not every command has a body. A read-only request with a bearer token is even simpler, because there is no method or body to set — only the header survives:

curl https://api.example.com/me \
  -H "Authorization: Bearer abc123" \
  -H "Accept: application/json"

becomes

fetch("https://api.example.com/me", {
  headers: {
    "Authorization": "Bearer abc123",
    "Accept": "application/json"
  }
})
  .then((res) => res.json())
  .then(console.log);

With no -X and no -d, the method defaults to GET, so it can be omitted entirely — fetch() uses GET by default. If the same endpoint used HTTP Basic auth instead (-u ada:secret), the converter would replace it with "Authorization": "Basic YWRhOnNlY3JldA==" — the base64 of ada:secret — since fetch() has no credentials shorthand of its own.

A flag-by-flag reference

Beyond the four core flags, here is how the common curl options you meet in API docs and “Copy as cURL” output land in a fetch() call:

curl flag	Meaning	fetch handling
-X / --request	HTTP method	method: "…"
-H / --header	Request header	Entry in headers: { … }
-d / --data / --data-raw	Request body	body: "…", implies POST
--data-urlencode	URL-encoded body field	Encoded, then appended to body
-u / --user	HTTP Basic auth	Authorization: Basic <base64> header
-b / --cookie (inline)	Cookie header	Cookie header (string form)
-L / --location	Follow redirects	Dropped — fetch() follows by default
-s, -v, -k, --compressed	curl transport/output behaviour	Dropped — no effect on the request
-F / --form	Multipart upload	Not emitted (needs FormData)

The rule of thumb: flags that describe the request the server sees convert; flags that describe how curl behaves on your machine do not.

The gotchas worth knowing

• A body implies POST. In curl, -d alone switches the request to POST — you don’t need -X POST. fetch has no such default, so the converter sets method: "POST" for you.
• Multiple -d flags join with &. curl -d name=ada -d age=36 sends name=ada&age=36; the same concatenation applies in the fetch body.
• Form data gets a default Content-Type. When you send -d without a Content-Type header, curl uses application/x-www-form-urlencoded. To send JSON, set -H "Content-Type: application/json" explicitly — otherwise your API may misread the body.
• -u is base64 Basic auth. -u user:pass becomes Authorization: Basic <base64(user:pass)>. Bearer tokens are just a normal header (-H "Authorization: Bearer …") and carry through unchanged.

What doesn’t convert (on purpose)

Some curl features don’t have a clean one-line fetch() equivalent:

• -F multipart uploads — these need a FormData object built field by field, which depends on where your files come from in the browser or Node.
• Cookie jars (-c/-b writing to files) — fetch manages cookies through the environment, not a file.
• Client certificates — configured at the agent/environment level, not in a fetch() call.

Leaving these out keeps the generated code honest rather than emitting something that looks right but won’t run.

Why convert it in the browser

curl commands from real work carry real secrets — API keys, bearer tokens, basic-auth credentials. A converter that sends the command to a server has just been handed those secrets. The curl to fetch converter parses everything locally with a shell-aware tokenizer, so the command — and anything sensitive in it — never leaves your browser, and it works offline.

The bottom line

Converting curl to fetch() is a fixed mapping: -X → method, -H → headers, -d → body, URL → first argument, with POST implied by a body. Know that and you can translate any everyday curl command by hand — or paste it into the converter and copy the fetch() call straight into your code.