How to copy a request as cURL in Chrome

1. Open DevTools on the page that makes the request: F12 or Ctrl+Shift+I on Windows and Linux, Cmd+Option+I on Mac.
2. Select the Network panel. If it is hidden, click the >> overflow arrow in the tab bar, or press Ctrl+Shift+P (Cmd+Shift+P) and type "network".
3. Trigger the request. The panel only records while DevTools is open, so reload the page or repeat the click or form submit. Check Preserve log if the action redirects.
4. Find the request. Click Fetch/XHR in the filter bar to hide images and scripts, or type part of the URL in the filter box. Failed requests show their status in red.
5. Right-click the request in the Name column and hover over Copy.
6. Choose the format. Copy as cURL on Mac and Linux. On Windows, Copy as cURL (bash) or Copy as cURL (cmd). The command goes to your clipboard.
7. Paste and run it in a terminal. You should get the same response the browser received.

The same Copy submenu has Copy all as cURL, which copies every request in the list as a chain of commands. With a filter active it becomes Copy all listed as cURL. Requests to blob: URLs cannot be copied because they only exist inside the browser.

A copied command for a JSON API call in current Chrome looks like this (shortened):

curl --url 'https://api.example.com/v1/orders?limit=20' \
  -H 'accept: application/json' \
  -H 'authorization: Bearer eyJhbGciOiJIUzI1NiIs...' \
  -b 'session_id=8f2c41d0; theme=dark' \
  -H 'content-type: application/json' \
  -H 'origin: https://app.example.com' \
  -H 'user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) ...' \
  --data-raw '{"status":"open"}'

Chrome leaves out Accept-Encoding so cURL does not print compressed bytes, and drops headers cURL sets itself, such as Host. Everything else is a faithful copy of what the page sent.

Mac and Linux show a single Copy as cURL option. Windows shows two, because Command Prompt cannot read the single-quote and backslash syntax bash uses.

curl --url ^"https://api.example.com/v1/orders?limit=20^" ^
  -H ^"accept: application/json^" ^
  -H ^"authorization: Bearer eyJhbGciOiJIUzI1NiIs...^" ^
  -b ^"session_id=8f2c41d0; theme=dark^"

Once the command runs, add flags to see more and edit any part to test a theory. Keep the headers from the original command where the examples show ....

# Show response headers and status line, keep the body
curl -i --url 'https://api.example.com/v1/orders?limit=20' -H 'accept: application/json' ...

# Verbose: TLS, redirects and every header sent and received
curl -v --url 'https://api.example.com/v1/orders?limit=20' ...

# Pretty-print a JSON response (needs jq)
curl -s --url 'https://api.example.com/v1/orders?limit=20' ... | jq .

# Replay the same request against your local API
curl --url 'http://localhost:3000/v1/orders?limit=20' ...

# Windows PowerShell: call curl.exe, not the curl alias
curl.exe --url "https://api.example.com/v1/orders?limit=20" -H "accept: application/json"

• Change one thing at a time. Edit a field in --data-raw or a query parameter to find the input that triggers a 400 or 500.
• Point it at another environment. Swap the host for staging or localhost to check whether a fix works with the exact payload from production.
• Got 401 or 403 on replay? The session or CSRF token has expired. Copy the request again right after reproducing.
• Need to replay in the browser instead? Right-click a request and choose Resend (called Replay XHR in older Chrome), or Edit and resend as fetch, which puts an editable fetch call in the Console.

The Copy submenu also offers Copy as fetch, which produces a JavaScript fetch() call you can paste into the Console on the same site:

fetch("https://api.example.com/v1/orders?limit=20", {
  "headers": {
    "accept": "application/json",
    "authorization": "Bearer eyJhbGciOiJIUzI1NiIs...",
    "content-type": "application/json"
  },
  "referrer": "https://app.example.com/",
  "body": "{\"status\":\"open\"}",
  "method": "POST",
  "mode": "cors",
  "credentials": "include"
});

Browser fetch cannot set some headers, such as user-agent and cookie, so Chrome leaves them out of the browser version. An authorization header is still copied, so check it before sharing.

1. Replace the -b cookie value with [redacted], or delete the line if the request does not need a session.
2. Replace authorization, x-api-key, x-csrf-token and similar header values.
3. Check the URL for token=, key= or session= parameters.
4. Read the --data-raw body for passwords, card numbers and personal data.
5. If you already shared a live command, log out or revoke the token so the session stops working.

For bash-format commands, this masks the most common values automatically. Commands that use $'...' quoting still need a manual check:

# macOS: paste the copied command into a file (Linux: wl-paste or xclip -o)
pbpaste > request.sh

# Mask cookies and common auth headers, keep everything else
perl -pe 's/(-b|--cookie) \x27[^\x27]*\x27/$1 \x27[redacted]\x27/g;
          s/(-H \x27(?:authorization|cookie|x-api-key|x-csrf-token|x-xsrf-token): )[^\x27]*\x27/$1\[redacted]\x27/gi' \
  request.sh > request.redacted.sh

# Double-check nothing obvious is left
grep -Eio '(token|secret|password|session|bearer)[^ ]{0,30}' request.redacted.sh

Sharing a whole session rather than one request? A sanitized HAR file is safer: see how to capture a HAR file in Chrome. Pair the request with the matching error from the console log and it usually explains the failure on its own.

Copy as cURL needs DevTools open before the request happens, and every command needs a manual secrets check. Bugmark is a Chrome extension that keeps a rolling network log for the tab, so the failing request is already captured when you report the bug.

• Records the last 150 requests (fetch, XHR and resources) with method, URL, status and timing.
• For the 60 most recent fetch/XHR calls, keeps query params, request headers and payload, response headers and response body.
• Masks secrets before saving: passwords, tokens, API keys, session IDs, card numbers and Authorization/Cookie headers become [redacted].
• Filter to failures, Copy as cURL, or Download HAR and open it in Chrome DevTools.
• Attaches the screenshot, console errors and steps to reproduce to the same report.

Because commands are built from the already-masked log, you add your own test credentials when replaying. Bugmark is free to try with every feature unlocked, up to 2 saved reports at a time; a one-time $15 payment removes the limit, with no subscription or account. Add Bugmark to Chrome