Complete tutorial on authenticating API requests with cURL. Learn how to implement HTTP Basic Auth, Bearer JWT tokens, API Key headers, OAuth2 Client Credentials flows, and client SSL certificates.
Frequently Asked Questions
Q1. How do I avoid exposing my password in shell history when using -u?
You can pass -u username without the password. cURL will interactively prompt you to type the password securely without printing characters on screen. Alternatively, store credentials in environment variables: -u "$API_USER:$API_PASS".
Q2. What is the difference between Basic Auth and Bearer Token authentication?
Basic Auth transmits Base64-encoded username and password credentials directly on every request. Bearer Token authentication transmits an opaque or cryptographically signed token (like a JWT) issued by an OAuth2 authorization server.
Q3. How do I pass an API key in the cURL URL query string?
Append it to the target URL: curl "https://api.example.com/v1/weather?city=London&appid=YOUR_API_KEY_HERE". Always wrap the URL in quotes to prevent & from breaking the shell process.
Q4. How do I use a .netrc file with cURL for automatic authentication?
Add your credentials to ~/.netrc (machine api.example.com login user password secret) and call cURL with the -n or --netrc flag.