APITesterThe command
curl -u ada:s3cret https://httpbin.org/basic-auth/ada/s3cret
Opens the request console with this request filled in. It is sent from api-tester.com's server rather than from your machine, so it shows what the endpoint returns, not how your own network or curl build behaves.
What the flags do
| Flag | What it does |
|---|---|
-u user:password | Send credentials. Long form: --user. |
-u user | Curl prompts for the password, so it never appears in history. |
-n | Read credentials for the host from ~/.netrc. |
--digest / --anyauth | Use Digest, or let curl pick the strongest scheme the server offers. |
What -u actually sends
Curl joins the two values with a colon, Base64-encodes the result and sends it in a header. The two commands below are the same request. Base64 is an encoding, not encryption: anyone who sees the header can decode it instantly, so Basic auth is only acceptable over HTTPS.
Curl sends the header on the first request without waiting to be challenged. That is what APIs expect, and it also means the credentials go out even if the server never asked for them.
curl -u ada:s3cret https://httpbin.org/basic-auth/ada/s3cret
curl -H "Authorization: Basic YWRhOnMzY3JldA==" https://httpbin.org/basic-auth/ada/s3cret
echo -n "ada:s3cret" | base64 # YWRhOnMzY3JldA==Keeping the password off the command line
A password typed after -u lands in shell history and is visible to other users in the process list while curl runs. Give only the username and curl asks for the password. For unattended scripts, use a .netrc file readable only by you, or read the value from an environment variable set by your secret store.
curl -u ada https://api.example.com/account # prompts
# ~/.netrc (chmod 600)
# machine api.example.com login ada password s3cret
curl -n https://api.example.com/account
curl -u "ada:$API_PASSWORD" https://api.example.com/accountBasic auth on a POST, and API keys as usernames
-u combines with any method and body; it only adds a header. Many APIs also use Basic auth as a carrier for an API key, with the key as the username and an empty password. The trailing colon tells curl there is no password, so it does not prompt.
curl -u ada:s3cret -H "Content-Type: application/json" \
-d '{"name":"report"}' https://httpbin.org/post
curl -u "sk_test_PLACEHOLDER:" https://api.example.com/v1/chargesCommon mistakes
- A username cannot contain a colon; the first colon ends it. The password can.
- With
-L, credentials are not sent to a different host after a redirect, which is why a login that redirects can end in401.--location-trustedoverrides that, and should be used only when you trust every hop. - Credentials in the URL (
https://user:pass@host/) work too, and end up in logs and history far more easily.
Related curl examples
Curl -u Flag Example
-u hands curl a username and a password.
Curl POST With Basic Authentication Example
A POST with Basic authentication is two separate things in one command: a header that identifies you and a body that carries the data.
Curl Request With Credentials Example
"Credentials" covers several unrelated mechanisms, and an API accepts exactly the one it was built for.
Curl Bearer Token Auth Header Example
A bearer token is a credential you present in a header; whoever holds it is treated as its owner.
All Curl Examples
49 worked examples, grouped by what you are trying to do.
References
- curl man page: -u — Supplying a username and password.
- MDN: HTTP authentication — The challenge and response framework and the Basic scheme.
These links leave api-tester.com, which is independent of the projects they point to.
FAQ
How do I use Basic authentication with curl?
Pass -u username:password. Curl Base64-encodes the pair and sends it in an Authorization: Basic header.
What does the -u flag do in curl?
It supplies a username and password for server authentication, which curl sends as HTTP Basic credentials by default.
How do I avoid putting my password in the curl command?
Give only the username with -u so curl prompts for the password, or store credentials in a .netrc file and use -n.