Headers, authentication, and cookies are how a request presents itself to a server.
-H "Name: value" adds a header; repeat it for several. Authentication has two common shapes. -u user:password is HTTP Basic: curl base64-encodes the pair into an Authorization header. A bearer token is simply a header: -H "Authorization: Bearer TOKEN". Both are credentials, so any command that includes them should be handled as sensitive.
Cookies arrive with -b / --cookie (send a cookie, or read them from a file) and are saved with -c / --cookie-jar.
When you translate the request, HTTP Basic becomes the target language's auth mechanism, for example the auth=(user, password) tuple in Python requests, while a bearer token stays a plain header in every language. The HTTP request translator never sends the request, so any token, password or cookie pasted into it is decoded in the browser and goes nowhere.
Where the credential actually ends up
A password on a curl command line does not stay on the command line. It goes into shell history, and on most systems it is visible in the process list to anyone who can run ps while the command executes — including other users on a shared jump host.
-u user without the colon makes curl prompt instead. --netrc reads credentials from a file. A config file passed with -K keeps them out of argv entirely.
This is why a working command copied from a ticket into a shared bastion is a small credential disclosure, and why history on a shared account is worth reading before you assume a secret is still secret.