cURL to Dart and Flutter Converter

The http package sends a Map<String, String> body as an HTML form and sets that content type itself. A String body is sent as is, so JSON needs both jsonEncode and a JSON Content-Type header. Dio encodes maps as JSON unless you ask for a form.

Start with http: it is small, maintained by the Dart team and enough for most apps. Reach for Dio when many calls need the same interceptors (token refresh, logging, retries), or when you want upload progress built in.

The generated code runs as is with dart run. To use it in Flutter:

1. Add the package: flutter pub add http (or dio). Multipart uploads with a content type also need flutter pub add http_parser.
2. Move the body of main() into an async method, such as Future<User> fetchUser(), and call it from a FutureBuilder or your state management.
3. On Android, release builds need the internet permission in AndroidManifest.xml: <uses-permission android:name="android.permission.INTERNET" />. Debug builds include it automatically.
4. On macOS, enable the com.apple.security.network.client entitlement.
5. Prefer https URLs: Android 9 and later block plain http traffic by default.

Code that reads a File or creates its own HttpClient (for -k, proxies or connect timeouts) depends on dart:io, so it doesn't run on Flutter web.

Dio throws a DioException for timeouts, connection failures and, by default, any status outside 2xx. Its type tells you which one happened, so you can decide what is worth retrying:

try {
  final response = await dio.get('https://api.example.com/v1/orders');
  print(response.data);
} on DioException catch (e) {
  if (e.type == DioExceptionType.badResponse) {
    print('HTTP ${e.response?.statusCode}: ${e.response?.data}');
  } else if (e.type == DioExceptionType.connectionTimeout ||
      e.type == DioExceptionType.receiveTimeout) {
    print('Timed out; safe to retry a GET');
  } else {
    rethrow;
  }
}

Dio doesn't retry on its own. Add a retry interceptor (the dio_smart_retry package is one) or loop with a short delay, and retry only idempotent requests such as GET, PUT and DELETE unless the API supports idempotency keys. Create one Dio instance with your base URL, headers and interceptors and reuse it across the app, rather than calling Dio() per request.

Copying requests from a browser? See how to copy as cURL in Chrome or Firefox DevTools. Browser copies carry headers a mobile app never sends, such as sec-ch-ua and origin: turn on Drop browser headers for the sec-* group and delete origin and referer unless the API checks them.

No. Anything compiled into an app can be pulled out of the APK or IPA, so a key in your Dart code is effectively public. Keep secrets on a server you control and have the app call it, or use short-lived tokens issued to each user after sign-in.

The converter itself is private: it runs in your browser and never uploads your command. While testing, read values from the environment: $API_TOKEN in the command becomes Platform.environment['API_TOKEN']! in the generated Dart. That suits scripts; Flutter apps usually pass build-time values with --dart-define, which are not secret either.

The Contains credentials badge flags anything still hard-coded, and a badCertificateCallback that returns true must never reach a release build.