cURL to Python Requests Converter

cURL to Python Requests example

A typical JSON API call contains a POST method, authorization and content-type headers, and a body:

curl -L -X POST https://api.example.com/v1/users \
  -H 'Authorization: Bearer test-token' \
  -H 'Content-Type: application/json' \
  -d '{"name":"Ada","active":true}'

The generated program imports requests and calls requests.request(). This generic API keeps one stable structure for GET, POST, PUT, PATCH, DELETE, HEAD, and custom HTTP methods. The converter maps the URL and method directly, keeps bearer tokens in the headers dictionary, emits valid JSON as a Python dictionary through the json argument, and sets allow_redirects=True when cURL uses -L.

JSON, form data, and headers

When the request declares application/json and the body parses successfully, Cryonel converts JSON strings, numbers, arrays, objects, booleans, and null values into valid Python literals. JSON true, false, and null therefore become True, False, and None. Requests serializes the value supplied through its json parameter.

Other body content is passed through data as a string. If cURL data has no content-type header, the shared parser adds application/x-www-form-urlencoded to match cURL’s default. Custom headers are preserved exactly except for browser-controlled Cookie, Host, and Content-Length values, which this privacy-first converter refuses rather than guessing.

Authentication and redirects

A cURL --user username:password option becomes a two-item auth tuple. Requests uses that tuple for HTTP Basic authentication. Bearer tokens, API keys, and custom schemes should remain explicit headers. The converter rejects a command that combines --user with another Authorization header because Requests may otherwise send credentials different from what the reader expects.

cURL only follows redirects when requested with -L. The generated code therefore writes allow_redirects=True for that flag and False otherwise, preserving the command’s intent. Review cross-origin redirects carefully because credentials and sensitive headers must never be forwarded to an untrusted destination.

Response handling and timeouts

The result calls response.raise_for_status() before printing response.text. That turns unsuccessful HTTP status responses into exceptions instead of quietly treating a 404 or 500 body as success. Requests does not apply a timeout unless one is specified. Add a suitable timeout value for production code based on the API’s expected connect and response times; the converter does not invent one because it would change the original command’s behavior.

Unsupported cURL features

This first version rejects cookie files, multipart forms, file-backed bodies such as @payload.json, client certificates, insecure TLS mode, and URL-encoded data flags. Python Requests can implement several of these features, but a browser converter cannot read local shell files or safely infer filesystem paths. Convert the core request first, then add reviewed files, cookies, cert, verify, or proxy options directly in trusted Python code.

Security and privacy

Commands copied from real systems frequently contain bearer tokens, passwords, customer payloads, or internal hostnames. Cryonel parses the text locally and never sends the target request. The generated source still contains those values. Replace secrets before committing, logging, or sharing it, and use an environment variable or secret manager in production.