A curl command has three parts: the program name (curl), zero or more options, and a target URL. Before curl ever sees them, the shell splits the line into words and removes one layer of quoting.
Quoting matters because bodies and headers contain spaces and special characters. Single quotes are literal: everything between them is passed through untouched, which is why JSON bodies are usually wrapped in single quotes. Double quotes let the shell expand variables and interpret a few backslash escapes. A backslash at the end of a line is a line continuation, joining the next line, which is how "Copy as cURL" produces readable multi-line commands.
Options come in short and long forms. Short flags are one dash and a letter (-X, -H, -d); long flags are two dashes and a word (--request, --header, --data). Short flags can be clustered: -sSL is -s -S -L. A flag that takes a value can have the value attached with no space, so -XPOST means -X POST, which trips up quick readers.
Anything that is not an option and not an option's value is the URL. When the scheme is missing, curl guesses it: it defaults to HTTP, and assumes for a host that starts with ftp..
Read it in the order the request is built, not the order it was typed
A curl command's flags can appear in any order, which means the sequence on the page has nothing to do with the sequence of what happens. Reading left to right is reading the author's typing habits.
The order that matters is the request's own: method, then URL, then headers, then body, then what happens to the response. Reconstructing the command that way turns a long line into five short questions, and makes the missing piece obvious: a -d with no content type, an -H that duplicates something curl sets anyway, a redirect flag that changes what the whole thing does.
A command you cannot restate in that order is one you have not finished reading, which matters most when the command came from somebody else and you are about to run it.
This series, in order
This article opens the series curl, flag by flag. It shows how the shell splits the line before curl sees it; the parts then read the request the command builds, in the order it is assembled (method, body, headers and credentials), check its security posture, translate it for the browser, and end with everything curl speaks besides HTTP.
- How curl Infers the HTTP Method. Why a body implies POST, -I implies HEAD and -G forces GET, and why an explicit -X always wins.
- curl Data Flags and the Content-Type Trap. The ways to attach a body, and the trap: -d sends form encoding, not JSON.
- Headers, Authentication, and Cookies in curl. -H, -u, a bearer token as a plain header, and -b and -c for cookies: everything that identifies the request.
- curl Flags That Change Security Posture. -k, plain http and credentials in the URL: the flags worth reading before a command is run or shared.
- Translating curl to fetch(). The same request in the browser's fetch(), and the differences that need care: form Content-Type, cookies, TLS checks.
- The 27 Protocols curl Speaks. FTP, , , , , , (Lightweight Directory Access Protocol) and the relics: the 27 URL schemes curl speaks today.