From curl to fetch, axios, and Python: the API integration workflow

Why curl became the API lingua franca

Every API vendor docs their endpoints in curl. Postman exports as curl. Chrome DevTools has "Copy as cURL" in the Network tab. Stack Overflow answers about "how do I call X API" almost always paste curl.

The reason: curl is the shortest, most portable, executable-in-one-line way to describe an HTTP request. But nobody ships production code that calls curl. You need it in JavaScript (fetch, axios), Python (requests, httpx), Go, Rust, or whatever your stack is.

That translation — curl to code — is the workflow this post is about.

The core curl flags and their mappings

-X POST (--request): the HTTP method.

// fetch
fetch(url, { method: "POST" })

Note: if you pass -d (data), curl defaults to POST automatically, so -X becomes redundant. fetch doesn't have this shortcut.

-H "Content-Type: application/json" (--header): a request header.

fetch(url, { headers: { "Content-Type": "application/json" } })

-d '{"name":"Ada"}' (--data): the request body. Sends as application/x-www-form-urlencoded by default in curl; use --data-raw to send exactly as-is.

fetch(url, { method: "POST", body: JSON.stringify({ name: "Ada" }) })

--json '{"name":"Ada"}': shortcut in curl 7.82+ — sets Content-Type and Accept headers to application/json and POSTs the body.

-u user:pass (--user): HTTP Basic auth. Turns into an Authorization: Basic <base64> header.

fetch(url, { headers: { Authorization: "Basic " + btoa("user:pass") } })

-b cookie=value (--cookie): send a cookie. Turns into a Cookie: header.

-A "MyBot/1.0" (--user-agent): short for -H "User-Agent: MyBot/1.0".

The flags that don't translate cleanly

• -L (--location): follow redirects. In fetch this is the default (redirect: 'follow'). In axios, controlled by maxRedirects. Python requests follows by default.
• -k (--insecure): skip TLS verification. Never do this in production code. In Node fetch: agent: new https.Agent({ rejectUnauthorized: false }). Python: verify=False.
• -o file.json (--output): write to a file. In JS, you'd await res.arrayBuffer() and pipe to fs.
• -v (--verbose): debugging output. No JS equivalent — use browser DevTools or Node's NODE_DEBUG=http.
• -i / -I: include headers in output / HEAD request only.
• --compressed: request gzip. Fetch does this by default; axios does too.

If you're pasting a curl with these flags and getting subtly different behavior in JS, one of them is the culprit.

The three-second workflow

1. Copy as cURL from Chrome DevTools (right-click any request → Copy → Copy as cURL).
2. Paste into cURL Converter.
3. Pick fetch, axios, or Python — code appears with the right headers, method, and body wiring.
4. Adjust variable names — the tool doesn't know your API_URL env var.

For most API integrations, that's 30 seconds from doc to working code.

When the API returns wrong status codes

Every debug session eventually hits a mysterious 4xx. The reference:

• 400 — malformed request. Bad JSON, missing required field.
• 401 — auth missing or expired. Check the token.
• 403 — auth valid but not allowed. Different from 401 — re-auth won't help.
• 404 — wrong URL. Check the base URL and route.
• 422 — well-formed but semantically invalid. Common in modern JSON APIs.
• 429 — rate limited. Check Retry-After header.

HTTP Status Codes has the full reference. Search by code or by keyword.

Auth flows are the biggest translation traps

Bearer tokens (JWT):

curl -H "Authorization: Bearer eyJhbG..." https://api.example.com/me

Maps cleanly to any language. The trap: when the JWT expires, curl gives you a 401 immediately, but your library may not — axios interceptors are the usual place to add refresh logic.

To inspect what's inside the token during debugging, use JWT Decoder — locally, so you don't paste production credentials into a random online tool.

OAuth flows: curl can't do the redirect steps. Use a library or the vendor's SDK. Once you have the access token, the curl → fetch pattern above works.

API keys in query strings vs headers: vendors vary. AWS uses signed URLs, Stripe uses Authorization: Bearer, OpenAI uses Authorization: Bearer, older APIs use ?api_key=. Read the auth docs; don't assume.

Multi-part uploads

curl handles multi-part uploads with -F:

curl -F "file=@photo.jpg" -F "caption=Sunset" https://api.example.com/upload

The JavaScript equivalent uses FormData (not JSON.stringify):

const fd = new FormData();
fd.append("file", fileInput.files[0]);
fd.append("caption", "Sunset");
await fetch(url, { method: "POST", body: fd });
// Don't set Content-Type — the browser adds the boundary automatically

The single most common mistake: setting Content-Type: multipart/form-data yourself. The browser must set it because it needs to include the boundary. Let it.

Related workflows

• HTTP Status Codes — for the "why is this 422?" moment.
• JWT Decoder — for inspecting tokens without leaking them.
• JSON Formatter — for eyeballing API responses.
• User-Agent Parser — when the API cares about your UA.