cURL to Python Requests Converter

Two details matter. json= re-serializes your data, so the spacing changes; if a server signs the exact bytes of the body, send the original string with data= instead. And requests only builds a multipart body when files= is present, so text-only -F fields become (None, value) tuples in files.

Use requests for scripts, notebooks and synchronous services; it is everywhere and nearly every tutorial uses it. Use httpx for asyncio code such as FastAPI handlers and async workers, or when you need HTTP/2. Whichever you choose, set a timeout: a requests call without one can hang forever on a stalled server.

The converter maps every option it can, but a few behaviors differ by design:

• Timeouts. curl -m 30 caps the whole transfer. In requests, timeout=30 limits the connection and each read separately, so a slow trickle of data can run longer.
• Compression. curl's --compressed needs no code: both libraries ask for gzip and decode it. The converter drops a copied Accept-Encoding header because requests can only decode Brotli (br) when the brotli package is installed.
• Redirects. curl stops at a 3xx unless you pass -L. Turn on Match curl redirects to add allow_redirects=False and get the same response curl shows.
• Default headers. Python sends its own User-Agent, such as python-requests/2.32. Some sites block it; keep the browser's User-Agent header from the copied command if you need to look like a browser.

Each top-level requests.get() call builds a fresh session: no connection reuse, and cookies are forgotten. Once a converted request becomes part of a script that makes several calls, switch to a Session:

import requests
from requests.adapters import HTTPAdapter
from urllib3.util.retry import Retry

session = requests.Session()
session.headers.update({"Accept": "application/json"})

retries = Retry(total=3, backoff_factor=0.5, status_forcelist=[429, 502, 503, 504])
session.mount("https://", HTTPAdapter(max_retries=retries))

response = session.get("https://api.example.com/v1/orders", timeout=30)

• Cookies. Cookies the server sets, after a login for example, go out automatically on the next call. That replaces curl's -c and -b cookie-jar files.
• Retries. The Retry policy is the counterpart of curl --retry. By default urllib3 only retries idempotent methods such as GET, PUT and DELETE, so a POST is not repeated unless you add it to allowed_methods.
• httpx. The same idea is httpx.Client(); httpx.HTTPTransport(retries=3) retries failed connections.

Copying requests from a browser? See how to copy as cURL in Chrome or Firefox DevTools. Cookies arrive in a -b flag or a Cookie header, depending on the browser, and the converter turns either one into a cookies dict.

The converter itself is private: it runs in your browser and never uploads or stores your command. The risk is the token you paste, which ends up in the generated code.

Read secrets from the environment instead. Write them as variables in the command, for example -H "Authorization: Bearer $API_TOKEN", and the converter emits:

headers = {
    "Authorization": f"Bearer {os.environ['API_TOKEN']}",
}

The Contains credentials badge and the amber line markers show any secret that is still hard-coded. And when verify=False makes urllib3 print an InsecureRequestWarning on every call, take it seriously: the request now accepts forged certificates, so keep it out of production.