;type=text/html' \
-F '=)' -F '=@textfile.txt' ... smtp://example.com
Data can be encoded for transfer using encoder=. Available encod?
ings are binary and 8bit that do nothing else than adding the
corresponding Content-Transfer-Encoding header, 7bit that only
rejects 8-bit characters with a transfer error, quoted-printable
and base64 that encodes data according to the corresponding
schemes, limiting lines length to 76 characters.
Example: send multipart mail with a quoted-printable text message
and a base64 attached file:
curl -F '=text message;encoder=quoted-printable' \
-F '=@localfile;encoder=base64' ... smtp://example.com
--form can be used several times in a command line
Example:
curl --form "name=curl" --form "file=@loadthis" https://example.com
This option is mutually exclusive with --data, --head and --up?
load-file. See also --data, --form-string and --form-escape.
--form-escape
(HTTP IMAP SMTP) Pass on names of multipart form fields and files
using backslash-escaping instead of percent-encoding.
If --form-escape is provided several times, the last set value is
used.
Example:
curl --form-escape -F 'field\name=curl' -F 'file=@load"this' https://example.com
Added in 7.81.0. See also --form.
--form-string
(HTTP SMTP IMAP) Similar to --form except that the value string
for the named parameter is used literally. Leading @ and < char?
acters, and the ";type=" string in the value have no special
meaning. Use this in preference to --form if there is any possi?
bility that the string value may accidentally trigger the @ or <
features of --form.
--form-string can be used several times in a command line
Example:
curl --form-string "name=data" https://example.com
See also --form.
--ftp-account
(FTP) When an FTP server asks for "account data" after username
and password has been provided, this data is sent off using the
ACCT command.
If --ftp-account is provided several times, the last set value is
used.
Example:
curl --ftp-account "mr.robot" ftp://example.com/
See also --user.
--ftp-alternative-to-user
(FTP) If authenticating with the USER and PASS commands fails,
send this command. When connecting to Tumbleweed's Secure Trans?
port server over FTPS using a client certificate, using "SITE
AUTH" tells the server to retrieve the username from the certifi?
cate.
If --ftp-alternative-to-user is provided several times, the last
set value is used.
Example:
curl --ftp-alternative-to-user "U53r" ftp://example.com
See also --ftp-account and --user.
--ftp-create-dirs
(FTP SFTP) When an FTP or SFTP URL/operation uses a path that
does not currently exist on the server, the standard behavior of
curl is to fail. Using this option, curl instead attempts to cre?
ate missing directories.
Providing --ftp-create-dirs multiple times has no extra effect.
Disable it again with --no-ftp-create-dirs.
Example:
curl --ftp-create-dirs -T file ftp://example.com/remote/path/file
See also --create-dirs.
--ftp-method
(FTP) Control what method curl should use to reach a file on an
FTP(S) server. The method argument should be one of the following
alternatives:
multicwd
Do a single CWD operation for each path part in the given
URL. For deep hierarchies this means many commands. This
is how RFC 1738 says it should be done. This is the de?
fault but the slowest behavior.
nocwd Do no CWD at all. curl does SIZE, RETR, STOR etc and gives
the full path to the server for each of these commands.
This is the fastest behavior.
singlecwd
Do one CWD with the full target directory and then operate
on the file "normally" (like in the multicwd case). This
is somewhat more standards compliant than "nocwd" but
without the full penalty of "multicwd".
If --ftp-method is provided several times, the last set value is
used.
Examples:
curl --ftp-method multicwd ftp://example.com/dir1/dir2/file
curl --ftp-method nocwd ftp://example.com/dir1/dir2/file
curl --ftp-method singlecwd ftp://example.com/dir1/dir2/file
See also --list-only.
--ftp-pasv
(FTP) Use passive mode for the data connection. Passive is the
internal default behavior, but using this option can be used to
override a previous --ftp-port option.
Reversing an enforced passive really is not doable but you must
then instead enforce the correct --ftp-port again.
Passive mode means that curl tries the EPSV command first and
then PASV, unless --disable-epsv is used.
Providing --ftp-pasv multiple times has no extra effect.
Example:
curl --ftp-pasv ftp://example.com/
This option is mutually exclusive with --ftp-port. See also
--disable-epsv.
-P, --ftp-port
(FTP) Reverse the default initiator/listener roles when connect?
ing with FTP. This option makes curl use active mode. curl then
commands the server to connect back to the client's specified ad?
dress and port, while passive mode asks the server to setup an IP
address and port for it to connect to. should be one
of:
interface
e.g. eth0 to specify which interface's IP address you want
to use (Unix only)
IP address
e.g. 192.168.10.1 to specify the exact IP address
hostname
e.g. my.host.domain to specify the machine
- make curl pick the same IP address that is already used
for the control connection. This is the recommended
choice.
Disable the use of PORT with --ftp-pasv. Disable the attempt to
use the EPRT command instead of PORT by using --disable-eprt.
EPRT is really PORT++.
You can also append ":[start]-[end]" to the right of the address,
to tell curl what TCP port range to use. That means you specify a
port range, from a lower to a higher number. A single number
works as well, but do note that it increases the risk of failure
since the port may not be available.
If --ftp-port is provided several times, the last set value is
used.
Examples:
curl -P - ftp:/example.com
curl -P eth0 ftp:/example.com
curl -P 192.168.0.2 ftp:/example.com
See also --ftp-pasv and --disable-eprt.
--ftp-pret
(FTP) Send a PRET command before PASV (and EPSV). Certain FTP
servers, mainly drftpd, require this non-standard command for di?
rectory listings as well as up and downloads in PASV mode.
Providing --ftp-pret multiple times has no extra effect. Disable
it again with --no-ftp-pret.
Example:
curl --ftp-pret ftp://example.com/
See also --ftp-port and --ftp-pasv.
--ftp-skip-pasv-ip
(FTP) Do not use the IP address the server suggests in its re?
sponse to curl's PASV command when curl connects the data connec?
tion. Instead curl reuses the same IP address it already uses for
the control connection.
This option is enabled by default (added in 7.74.0).
This option has no effect if PORT, EPRT or EPSV is used instead
of PASV.
Providing --ftp-skip-pasv-ip multiple times has no extra effect.
Disable it again with --no-ftp-skip-pasv-ip.
Example:
curl --ftp-skip-pasv-ip ftp://example.com/
See also --ftp-pasv.
--ftp-ssl-ccc
(FTP) Use CCC (Clear Command Channel) Shuts down the SSL/TLS
layer after authenticating. The rest of the control channel com?
munication is unencrypted. This allows NAT routers to follow the
FTP transaction. The default mode is passive.
Providing --ftp-ssl-ccc multiple times has no extra effect. Dis?
able it again with --no-ftp-ssl-ccc.
Example:
curl --ftp-ssl-ccc ftps://example.com/
See also --ssl and --ftp-ssl-ccc-mode.
--ftp-ssl-ccc-mode
(FTP) Set the CCC mode. The passive mode does not initiate the
shutdown, but instead waits for the server to do it, and does not
reply to the shutdown from the server. The active mode initiates
the shutdown and waits for a reply from the server.
Providing --ftp-ssl-ccc-mode multiple times has no extra effect.
Disable it again with --no-ftp-ssl-ccc-mode.
Example:
curl --ftp-ssl-ccc-mode active --ftp-ssl-ccc ftps://example.com/
See also --ftp-ssl-ccc.
--ftp-ssl-control
(FTP) Require SSL/TLS for the FTP login, clear for transfer. Al?
lows secure authentication, but non-encrypted data transfers for
efficiency. Fails the transfer if the server does not support
SSL/TLS.
Providing --ftp-ssl-control multiple times has no extra effect.
Disable it again with --no-ftp-ssl-control.
Example:
curl --ftp-ssl-control ftp://example.com
See also --ssl.
-G, --get
(HTTP) When used, this option makes all data specified with
--data, --data-binary or --data-urlencode to be used in an HTTP
GET request instead of the POST request that otherwise would be
used. curl appends the provided data to the URL as a query
string.
If used in combination with --head, the POST data is instead ap?
pended to the URL with a HEAD request.
Providing --get multiple times has no extra effect. Disable it
again with --no-get.
Examples:
curl --get https://example.com
curl --get -d "tool=curl" -d "age=old" https://example.com
curl --get -I -d "tool=curl" https://example.com
See also --data and --request.
-g, --globoff
Switch off the URL globbing function. When you set this option,
you can specify URLs that contain the letters {}[] without having
curl itself interpret them. Note that these letters are not nor?
mal legal URL contents but they should be encoded according to
the URI standard.
curl detects numerical IPv6 addresses when used in URLs and ex?
cludes them from the treatment, so they can still be used without
having to disable globbing.
Providing --globoff multiple times has no extra effect. Disable
it again with --no-globoff.
Example:
curl -g "https://example.com/{[]}}}}"
See also --config and --disable.
--happy-eyeballs-timeout-ms
Set the timeout for Happy Eyeballs.
Happy Eyeballs is an algorithm that attempts to connect to both
IPv4 and IPv6 addresses for dual-stack hosts, giving IPv6 a
head-start of the specified number of milliseconds. If the IPv6
address cannot be connected to within that time, then a connec?
tion attempt is made to the IPv4 address in parallel. The first
connection to be established is the one that is used.
The range of suggested useful values is limited. Happy Eyeballs
RFC 6555 says "It is RECOMMENDED that connection attempts be
paced 150-250 ms apart to balance human factors against network
load." libcurl currently defaults to 200 ms. Firefox and Chrome
currently default to 300 ms.
If --happy-eyeballs-timeout-ms is provided several times, the
last set value is used.
Example:
curl --happy-eyeballs-timeout-ms 500 https://example.com
See also --max-time and --connect-timeout.
--haproxy-clientip
(HTTP) Set a client IP in HAProxy PROXY protocol v1 header at the
beginning of the connection.
For valid requests, IPv4 addresses must be indicated as a series
of exactly 4 integers in the range [0..255] inclusive written in
decimal representation separated by exactly one dot between each
other. Heading zeroes are not permitted in front of numbers in
order to avoid any possible confusion with octal numbers. IPv6
addresses must be indicated as series of 4 hexadecimal digits
(upper or lower case) delimited by colons between each other,
with the acceptance of one double colon sequence to replace the
largest acceptable range of consecutive zeroes. The total number
of decoded bits must be exactly 128.
Otherwise, any string can be accepted for the client IP and get
sent.
It replaces --haproxy-protocol if used, it is not necessary to
specify both flags.
If --haproxy-clientip is provided several times, the last set
value is used.
Example:
curl --haproxy-clientip $IP
Added in 8.2.0. See also --proxy.
--haproxy-protocol
(HTTP) Send a HAProxy PROXY protocol v1 header at the beginning
of the connection. This is used by some load balancers and re?
verse proxies to indicate the client's true IP address and port.
This option is primarily useful when sending test requests to a
service that expects this header.
Providing --haproxy-protocol multiple times has no extra effect.
Disable it again with --no-haproxy-protocol.
Example:
curl --haproxy-protocol https://example.com
See also --proxy.
-I, --head
(HTTP FTP FILE) Fetch the headers only. HTTP-servers feature the
command HEAD which this uses to get nothing but the header of a
document. When used on an FTP or FILE URL, curl displays the file
size and last modification time only.
Providing --head multiple times has no extra effect. Disable it
again with --no-head.
Example:
curl -I https://example.com
See also --get, --verbose and --trace-ascii.
-H, --header
(HTTP IMAP SMTP) Extra header to include in information sent.
When used within an HTTP request, it is added to the regular re?
quest headers.
For an IMAP or SMTP MIME uploaded mail built with --form options,
it is prepended to the resulting MIME document, effectively in?
cluding it at the mail global level. It does not affect raw up?
loaded mails.
You may specify any number of extra headers. Note that if you
should add a custom header that has the same name as one of the
internal ones curl would use, your externally set header is used
instead of the internal one. This allows you to make even trick?
ier stuff than curl would normally do. You should not replace in?
ternally set headers without knowing perfectly well what you are
doing. Remove an internal header by giving a replacement without
content on the right side of the colon, as in: -H "Host:". If you
send the custom header with no-value then its header must be ter?
minated with a semicolon, such as -H "X-Custom-Header;" to send
"X-Custom-Header:".
curl makes sure that each header you add/replace is sent with the
proper end-of-line marker, you should thus not add that as a part
of the header content: do not add newlines or carriage returns,
they only mess things up for you. curl passes on the verbatim
string you give it without any filter or other safe guards. That
includes white space and control characters.
This option can take an argument in @filename style, which then
adds a header for each line in the input file. Using @- makes
curl read the header file from stdin.
Please note that most anti-spam utilities check the presence and
value of several MIME mail headers: these are "From:", "To:",
"Date:" and "Subject:" among others and should be added with this
option.
You need --proxy-header to send custom headers intended for an
HTTP proxy.
Passing on a "Transfer-Encoding: chunked" header when doing an
HTTP request with a request body, makes curl send the data using
chunked encoding.
WARNING: headers set with this option are set in all HTTP re?
quests - even after redirects are followed, like when told with
--location. This can lead to the header being sent to other hosts
than the original host, so sensitive headers should be used with
caution combined with following redirects.
"Authorization:" and "Cookie:" headers are explicitly not passed
on in HTTP requests when following redirects to other origins,
unless --location-trusted is used.
--header can be used several times in a command line
Examples:
curl -H "X-First-Name: Joe" https://example.com
curl -H "User-Agent: yes-please/2000" https://example.com
curl -H "Host:" https://example.com
curl -H @headers.txt https://example.com
See also --user-agent, --referer and --proxy-header.
-h, --help
Usage help. Provide help for the subject given as an optional ar?
gument.
If no argument is provided, curl displays the most important com?
mand line arguments.
The argument can either be a category or a command line option.
When a category is provided, curl shows all command line options
within the given category. Specify category "all" to list all
available options.
If "category" is specified, curl displays all available help cat?
egories.
If the provided subject is instead an existing command line op?
tion, specified either in its short form with a single dash and a
single letter, or in the long form with two dashes and a longer
name, curl displays a help text for that option in the terminal.
The help output is extensive for some options.
If the provided command line option is not known, curl says so.
Examples:
curl --help all
curl --help --insecure
curl --help -f
See also --verbose.
--hostpubmd5
(SFTP SCP) Pass a string containing 32 hexadecimal digits. The
string should be the 128 bit MD5 checksum of the remote host's
public key, curl refuses the connection with the host unless the
checksums match.
If --hostpubmd5 is provided several times, the last set value is
used.
Example:
curl --hostpubmd5 e5c1c49020640a5ab0f2034854c321a8 sftp://example.com/
See also --hostpubsha256.
--hostpubsha256
(SFTP SCP) Pass a string containing a Base64-encoded SHA256 hash
of the remote host's public key. curl refuses the connection with
the host unless the hashes match.
This feature requires libcurl to be built with libssh2 and does
not work with other SSH backends.
If --hostpubsha256 is provided several times, the last set value
is used.
Example:
curl --hostpubsha256 NDVkMTQxMGQ1ODdmMjQ3MjczYjAyOTY5MmRkMjVmNDQ= sftp://example.com/
Added in 7.80.0. See also --hostpubmd5.
--hsts
(HTTPS) Enable HSTS for the transfer. If the filename points to
an existing HSTS cache file, that is used. After a completed
transfer, the cache is saved to the filename again if it has been
modified.
If curl is told to use HTTP:// for a transfer involving a host?
name that exists in the HSTS cache, it upgrades the transfer to
use HTTPS. Each HSTS cache entry has an individual lifetime after
which the upgrade is no longer performed.
Specify a "" filename (zero length) to avoid loading/saving and
make curl just handle HSTS in memory.
You may want to restrict your umask to prevent other users on the
same system to access the created file.
If this option is used several times, curl loads contents from
all the files but the last one is used for saving.
--hsts can be used several times in a command line
Example:
curl --hsts cache.txt https://example.com
Added in 7.74.0. See also --proto.
--http0.9
(HTTP) Accept an HTTP version 0.9 response.
HTTP/0.9 is a response without headers and therefore you can also
connect with this to non-HTTP servers and still get a response
since curl simply transparently downgrades - if allowed.
HTTP/0.9 is disabled by default (added in 7.66.0)
Providing --http0.9 multiple times has no extra effect. Disable
it again with --no-http0.9.
Example:
curl --http0.9 https://example.com
See also --http1.1, --http2 and --http3.
-0, --http1.0
(HTTP) Use HTTP version 1.0 instead of using its internally pre?
ferred HTTP version.
Providing --http1.0 multiple times has no extra effect.
Example:
curl --http1.0 https://example.com
This option is mutually exclusive with --http1.1, --http2,
--http2-prior-knowledge and --http3. See also --http0.9 and
--http1.1.
--http1.1
(HTTP) Use HTTP version 1.1. This is the default with HTTP://
URLs.
Providing --http1.1 multiple times has no extra effect.
Example:
curl --http1.1 https://example.com
This option is mutually exclusive with --http1.0, --http2,
--http2-prior-knowledge and --http3. See also --http1.0 and
--http0.9.
--http2
(HTTP) Use HTTP/2.
For HTTPS, this means curl negotiates HTTP/2 in the TLS hand?
shake. curl does this by default.
For HTTP, this means curl attempts to upgrade the request to
HTTP/2 using the Upgrade: request header.
When curl uses HTTP/2 over HTTPS, it does not itself insist on
TLS 1.2 or higher even though that is required by the specifica?
tion. A user can add this version requirement with --tlsv1.2.
Providing --http2 multiple times has no extra effect.
Example:
curl --http2 https://example.com
For --http2 to work, it requires that the underlying libcurl is
built to support HTTP/2. This option is mutually exclusive with
--http1.1, --http1.0, --http2-prior-knowledge and --http3. See
also --http1.1, --http3, --no-alpn and --proxy-http2.
--http2-prior-knowledge
(HTTP) Issue a non-TLS HTTP request using HTTP/2 directly without
HTTP/1.1 Upgrade. It requires prior knowledge that the server
supports HTTP/2 straight away. HTTPS requests still do HTTP/2
the standard way with negotiated protocol versions in the TLS
handshake.
Since 8.10.0 if this option is set for an HTTPS request then the
application layer protocol version (ALPN) offered to the server
is only HTTP/2. Prior to that both HTTP/1.1 and HTTP/2 were of?
fered.
Providing --http2-prior-knowledge multiple times has no extra ef?
fect. Disable it again with --no-http2-prior-knowledge.
Example:
curl --http2-prior-knowledge https://example.com
For --http2-prior-knowledge to work, it requires that the under?
lying libcurl is built to support HTTP/2. This option is mutu?
ally exclusive with --http1.1, --http1.0, --http2 and --http3.
See also --http2 and --http3.
--http3
(HTTP) Attempt HTTP/3 to the host in the URL, but fallback to
earlier HTTP versions if the HTTP/3 connection establishment
fails or is slow. HTTP/3 is only available for HTTPS and not for
HTTP URLs.
This option allows a user to avoid using the Alt-Svc method of
upgrading to HTTP/3 when you know or suspect that the target
speaks HTTP/3 on the given host and port.
When asked to use HTTP/3, curl issues a separate attempt to use
older HTTP versions with a slight delay, so if the HTTP/3 trans?
fer fails or is slow, curl still tries to proceed with an older
HTTP version. The fallback performs the regular negotiation be?
tween HTTP/1 and HTTP/2.
Use --http3-only for similar functionality without a fallback.
curl cannot do HTTP/3 over any proxy.
Providing --http3 multiple times has no extra effect.
Example:
curl --http3 https://example.com
For --http3 to work, it requires that the underlying libcurl is
built to support HTTP/3. This option is mutually exclusive with
--http1.1, --http1.0, --http2, --http2-prior-knowledge and
--http3-only. Added in 7.66.0. See also --http1.1 and --http2.
--http3-only
(HTTP) Instruct curl to use HTTP/3 to the host in the URL, with
no fallback to earlier HTTP versions. HTTP/3 can only be used for
HTTPS and not for HTTP URLs. For HTTP, this option triggers an
error.
This option allows a user to avoid using the Alt-Svc method of
upgrading to HTTP/3 when you know that the target speaks HTTP/3
on the given host and port.
This option makes curl fail if a QUIC connection cannot be estab?
lished, it does not attempt any other HTTP versions on its own.
Use --http3 for similar functionality with a fallback.
Providing --http3-only multiple times has no extra effect.
Example:
curl --http3-only https://example.com
For --http3-only to work, it requires that the underlying libcurl
is built to support HTTP/3. This option is mutually exclusive
with --http1.1, --http1.0, --http2, --http2-prior-knowledge and
--http3. Added in 7.88.0. See also --http1.1, --http2 and
--http3.
--ignore-content-length
(FTP HTTP) For HTTP, ignore the Content-Length header. This is
particularly useful for servers running Apache 1.x, which reports
incorrect Content-Length for files larger than 2 gigabytes.
For FTP, this makes curl skip the SIZE command to figure out the
size before downloading a file.
Providing --ignore-content-length multiple times has no extra ef?
fect. Disable it again with --no-ignore-content-length.
Example:
curl --ignore-content-length https://example.com
See also --ftp-skip-pasv-ip.
-k, --insecure
(TLS SFTP SCP) By default, every secure connection curl makes is
verified to be secure before the transfer takes place. This op?
tion makes curl skip the verification step and proceed without
checking.
When this option is not used for protocols using TLS, curl veri?
fies the server's TLS certificate before it continues: that the
certificate contains the right name which matches the hostname
used in the URL and that the certificate has been signed by a CA
certificate present in the cert store. See this online resource
for further details: https://curl.se/docs/sslcerts.html
For SFTP and SCP, this option makes curl skip the known_hosts
verification. known_hosts is a file normally stored in the
user's home directory in the ".ssh" subdirectory, which contains
hostnames and their public keys.
WARNING: using this option makes the transfer insecure.
When curl uses secure protocols it trusts responses and allows
for example HSTS and Alt-Svc information to be stored and used
subsequently. Using --insecure can make curl trust and use such
information from malicious servers.
Providing --insecure multiple times has no extra effect. Disable
it again with --no-insecure.
Example:
curl --insecure https://example.com
See also --proxy-insecure, --cacert and --capath.
--interface
Perform the operation using a specified interface. You can enter
interface name, IP address or hostname. If you prefer to be spe?
cific, you can use the following special syntax:
if!
Interface name. If the provided name does not match an ex?
isting interface, curl returns with error 45.
host!
IP address or hostname.
ifhost!!
Interface name and IP address or hostname. This syntax re?
quires libcurl 8.9.0 or later.
If the provided name does not match an existing interface,
curl returns with error 45.
curl does not support using network interface names for this op?
tion on Windows.
That name resolve operation if a hostname is provided does not
use DNS-over-HTTPS even if --doh-url is set.
On Linux this option can be used to specify a VRF (Virtual Rout?
ing and Forwarding) device, but the binary then needs to either
have the CAP_NET_RAW capability set or to be run as root.
If --interface is provided several times, the last set value is
used.
Examples:
curl --interface eth0 https://example.com
curl --interface "host!10.0.0.1" https://example.com
curl --interface "if!enp3s0" https://example.com
See also --dns-interface.
--ip-tos
Set Type of Service (TOS) for IPv4 or Traffic Class for IPv6.
The values allowed for can be a numeric value between 1
and 255 or one of the following:
CS0, CS1, CS2, CS3, CS4, CS5, CS6, CS7, AF11, AF12, AF13, AF21,
AF22, AF23, AF31, AF32, AF33, AF41, AF42, AF43, EF, VOICE-ADMIT,
ECT1, ECT0, CE, LE, LOWCOST, LOWDELAY, THROUGHPUT, RELIABILITY,
MINCOST
If --ip-tos is provided several times, the last set value is
used.
Example:
curl --ip-tos CS5 https://example.com
Added in 8.9.0. See also --tcp-nodelay and --vlan-priority.
--ipfs-gateway
(IPFS) Specify which gateway to use for IPFS and IPNS URLs. Not
specifying this instead makes curl check if the IPFS_GATEWAY en?
vironment variable is set, or if a "~/.ipfs/gateway" file holding
the gateway URL exists.
If you run a local IPFS node, this gateway is by default avail?
able under "http://localhost:8080". A full example URL would look
like:
curl --ipfs-gateway http://localhost:8080 \
ipfs://bafybeigagd5nmnn2iys2f3
There are many public IPFS gateways. See for example:
https://ipfs.github.io/public-gateway-checker/
If you opt to go for a remote gateway you need to be aware that
you completely trust the gateway. This might be fine in local
gateways that you host yourself. With remote gateways there could
potentially be malicious actors returning you data that does not
match the request you made, inspect or even interfere with the
request. You may not notice this when using curl. A mitigation
could be to go for a "trustless" gateway. This means you locally
verify the data. Consult the docs page on trusted vs trustless:
https://docs.ipfs.tech/reference/http/gateway/#trusted-vs-trust?
less
If --ipfs-gateway is provided several times, the last set value
is used.
Example:
curl --ipfs-gateway https://example.com ipfs://
Added in 8.4.0. See also --help and --manual.
-4, --ipv4
Use IPv4 addresses only when resolving hostnames, and not for ex?
ample try IPv6.
Providing --ipv4 multiple times has no extra effect.
Example:
curl --ipv4 https://example.com
This option is mutually exclusive with --ipv6. See also
--http1.1 and --http2.
-6, --ipv6
Use IPv6 addresses only when resolving hostnames, and not for ex?
ample try IPv4.
Your resolver may respond to an IPv6-only resolve request by re?
turning IPv6 addresses that contain "mapped" IPv4 addresses for
compatibility purposes. macOS is known to do this.
Providing --ipv6 multiple times has no extra effect.
Example:
curl --ipv6 https://example.com
This option is mutually exclusive with --ipv4. See also
--http1.1 and --http2.
--json
(HTTP) Send the specified JSON data in a POST request to the HTTP
server. --json works as a shortcut for passing on these three op?
tions:
--data-binary [arg]
--header "Content-Type: application/json"
--header "Accept: application/json"
There is no verification that the passed in data is actual JSON
or that the syntax is correct.
If you start the data with the letter @, the rest should be a
filename to read the data from, or a single dash (-) if you want
curl to read the data from stdin. Posting data from a file named
'foobar' would thus be done with --json @foobar and to instead
read the data from stdin, use --json @-.
If this option is used more than once on the same command line,
the additional data pieces are concatenated to the previous be?
fore sending.
The headers this option sets can be overridden with --header as
usual.
--json can be used several times in a command line
Examples:
curl --json '{ "drink": "coffee" }' https://example.com
curl --json '{ "drink":' --json ' "coffee" }' https://example.com
curl --json @prepared https://example.com
curl --json @- https://example.com < json.txt
This option is mutually exclusive with --form, --head and --up?
load-file. Added in 7.82.0. See also --data-binary and
--data-raw.
-j, --junk-session-cookies
(HTTP) When curl is told to read cookies from a given file, this
option makes it discard all session cookies. This has the same
effect as if a new session is started. Typical browsers discard
session cookies when they are closed down.
Session cookies are cookies without a set expiry time. They are
meant to only last for "a session".
Providing --junk-session-cookies multiple times has no extra ef?
fect. Disable it again with --no-junk-session-cookies.
Example:
curl --junk-session-cookies -b cookies.txt https://example.com
See also --cookie and --cookie-jar.
--keepalive-cnt
Set the maximum number of keepalive probes TCP should send but
get no response before dropping the connection. This option is
usually used in conjunction with --keepalive-time.
This option is supported on Linux, *BSD/macOS, Windows
>=10.0.16299, Solaris 11.4, and recent AIX, HP-UX and more. This
option has no effect if --no-keepalive is used.
If unspecified, the option defaults to 9.
If --keepalive-cnt is provided several times, the last set value
is used.
Example:
curl --keepalive-cnt 3 https://example.com
Added in 8.9.0. See also --keepalive-time and --no-keepalive.
--keepalive-time
Set the time a connection needs to remain idle before sending
keepalive probes and the time between individual keepalive
probes. It is currently effective on operating systems offering
the "TCP_KEEPIDLE" and "TCP_KEEPINTVL" socket options (meaning
Linux, *BSD/macOS, Windows, Solaris, and recent AIX, HP-UX and
more). Keepalive is used by the TCP stack to detect broken net?
works on idle connections. The number of missed keepalive probes
before declaring the connection down is OS dependent and is com?
monly 8 (*BSD/macOS/AIX), 9 (Linux/AIX) or 5/10 (Windows), and
this number can be changed by specifying the curl option
"keepalive-cnt". Note that this option has no effect if
--no-keepalive is used.
If unspecified, the option defaults to 60 seconds.
If --keepalive-time is provided several times, the last set value
is used.
Example:
curl --keepalive-time 20 https://example.com
See also --no-keepalive, --keepalive-cnt and --max-time.
--key
(TLS SCP SFTP) Private key filename. Allows you to provide your
private key in this separate file. For SSH, if not specified,
curl tries the following candidates in order: "~/.ssh/id_rsa",
"~/.ssh/id_dsa", "./id_rsa", "./id_dsa".
If curl is built against OpenSSL library, and the engine pkcs11
or pkcs11 provider is available, then a PKCS#11 URI (RFC 7512)
can be used to specify a private key located in a PKCS#11 device.
A string beginning with "pkcs11:" is interpreted as a PKCS#11
URI. If a PKCS#11 URI is provided, then the --engine option is
set as "pkcs11" if none was provided and the --key-type option is
set as "ENG" or "PROV" if none was provided (depending on OpenSSL
version).
If curl is built against Schannel then this option is ignored for
TLS protocols (HTTPS, etc). That backend expects the private key
to be already present in the keychain or PKCS#12 file containing
the certificate.
If --key is provided several times, the last set value is used.
Example:
curl --cert certificate --key here https://example.com
See also --key-type and --cert.
--key-type
(TLS) Private key file type. Specify which type your --key pro?
vided private key is. DER, PEM, and ENG are supported. If not
specified, PEM is assumed.
If --key-type is provided several times, the last set value is
used.
Example:
curl --key-type DER --key here https://example.com
See also --key.
--knownhosts
(SCP SFTP) When doing SCP and SFTP transfers, curl automatically
checks a database containing identification for all hosts it has
ever been used with to verify that the host it connects to is the
same as previously. Host keys are stored in such a known hosts
file. curl uses the ~/.ssh/known_hosts in the user's home direc?
tory by default.
This option lets a user specify a specific file to check the host
against.
The known hosts check can be disabled with --insecure, but that
makes the transfer insecure and is strongly discouraged.
If --knownhosts is provided several times, the last set value is
used.
Example:
curl --knownhosts filename --key here https://example.com
Added in 8.17.0. See also --hostpubsha256, --hostpubmd5, --inse?
cure and --key.
--krb
(FTP) Deprecated option (added in 8.17.0). It has no function
anymore.
Enable Kerberos authentication and use. The level must be entered
and should be one of "clear", "safe", "confidential", or "pri?
vate". Should you use a level that is not one of these, "private"
is used.
If --krb is provided several times, the last set value is used.
Example:
curl --krb clear ftp://example.com/
For --krb to work, it requires that the underlying libcurl is
built to support Kerberos. See also --delegation and --ssl.
--libcurl
Append this option to any ordinary curl command line, and you get
libcurl-using C source code written to the file that does the
equivalent of what your command-line operation does.
This option is global and does not need to be specified for each
use of --next.
If --libcurl is provided several times, the last set value is
used.
Example:
curl --libcurl client.c https://example.com
See also --verbose.
--limit-rate
Specify the maximum transfer rate you want curl to use - for both
downloads and uploads. This feature is useful if you have a lim?
ited pipe and you would like your transfer not to use your entire
bandwidth. To make it slower than it otherwise would be.
The given speed is measured in bytes/second, unless a suffix is
appended. Appending 'k' or 'K' counts the number as kilobytes,
'm' or 'M' makes it megabytes, while 'g' or 'G' makes it giga?
bytes. The suffixes (k, M, G, T, P) are 1024 based. For example
1k is 1024. Examples: 200K, 3m and 1G.
The rate limiting logic works on averaging the transfer speed to
no more than the set threshold over a period of multiple seconds.
If you also use the --speed-limit option, that option takes
precedence and might cripple the rate-limiting slightly, to help
keep the speed-limit logic working.
If --limit-rate is provided several times, the last set value is
used.
Examples:
curl --limit-rate 100K https://example.com
curl --limit-rate 1000 https://example.com
curl --limit-rate 10M https://example.com
curl --limit-rate 200K --max-time 60 https://example.com
See also --rate, --speed-limit and --speed-time.
-l, --list-only
(FTP POP3 SFTP FILE) When listing an FTP directory, force a
name-only view. Maybe particularly useful if the user wants to
machine-parse the contents of an FTP directory since the normal
directory view does not use a standard look or format. When used
like this, the option causes an NLST command to be sent to the
server instead of LIST.
Note: Some FTP servers list only files in their response to NLST;
they do not include subdirectories and symbolic links.
When listing an SFTP directory, this switch forces a name-only
view, one per line. This is especially useful if the user wants
to machine-parse the contents of an SFTP directory since the nor?
mal directory view provides more information than just filenames.
When retrieving a specific email from POP3, this switch forces a
LIST command to be performed instead of RETR. This is particu?
larly useful if the user wants to see if a specific message-id
exists on the server and what size it is.
For FILE, this option has no effect yet as directories are always
listed in this mode.
Note: When combined with --request, this option can be used to
send a UIDL command instead, so the user may use the email's
unique identifier rather than its message-id to make the request.
Providing --list-only multiple times has no extra effect. Dis?
able it again with --no-list-only.
Example:
curl --list-only ftp://example.com/dir/
See also --quote and --request.
--local-port
Set a preferred single number or range (FROM-TO) of local port
numbers to use for the connection(s). Note that port numbers by
nature are a scarce resource so setting this range to something
too narrow might cause unnecessary connection setup failures.
If --local-port is provided several times, the last set value is
used.
Example:
curl --local-port 1000-3000 https://example.com
See also --globoff.
-L, --location
(HTTP) If the server reports that the requested page has moved to
a different location (indicated with a Location: header and a 3XX
response code), this option makes curl redo the request to the
new place. If used together with --show-headers or --head, head?
ers from all requested pages are shown.
When authentication is used, or when sending a cookie with "-H
Cookie:", curl only sends its credentials to the initial host. If
a redirect takes curl to a different host, it does not get the
credentials passed on. See --location-trusted on how to change
this.
Limit the amount of redirects to follow by using the --max-redirs
option.
When curl follows a redirect and if the request is a POST, it
sends the following request with a GET if the HTTP response was
301, 302, or 303. If the response code was any other 3xx code,
curl resends the following request using the same unmodified
method.
You can tell curl to not change POST requests to GET after a 30x
response by using the dedicated options for that: --post301,
--post302 and --post303.
The method set with --request overrides the method curl would
otherwise select to use.
Restrict which protocols a redirect is accepted to follow with
--proto-redir.
Providing --location multiple times has no extra effect. Disable
it again with --no-location.
Example:
curl -L https://example.com
See also --resolve, --alt-svc, --follow, --proto-redir and
--max-redirs.
--location-trusted
(HTTP) Instruct curl to follow HTTP redirects like --location,
but permit curl to send credentials and other secrets along to
other hosts than the initial one.
This may or may not introduce a security breach if the site redi?
rects you to a site to which you send this sensitive data to. An?
other host means that one or more of hostname, protocol scheme or
port number changed.
This option also allows curl to pass long cookies set explicitly
with --header.
Providing --location-trusted multiple times has no extra effect.
Disable it again with --no-location-trusted.
Examples:
curl --location-trusted -u user:password https://example.com
curl --location-trusted -H "Cookie: session=abc" https://example.com
See also --user and --follow.
--login-options
(IMAP LDAP POP3 SMTP) Specify the login options to use during
server authentication.
You can use login options to specify protocol specific options
that may be used during authentication. At present only IMAP,
POP3 and SMTP support login options. For more information about
login options please see RFC 2384, RFC 5092 and the IETF draft
https://datatracker.ietf.org/doc/html/draft-earhart-url-smtp-00
Since 8.2.0, IMAP supports the login option "AUTH=+LOGIN". With
this option, curl uses the plain (not SASL) "LOGIN IMAP" command
even if the server advertises SASL authentication. Care should be
taken in using this option, as it sends your password over the
network in plain text. This does not work if the IMAP server dis?
ables the plain "LOGIN" (e.g. to prevent password snooping).
If --login-options is provided several times, the last set value
is used.
Example:
curl --login-options 'AUTH=*' imap://example.com
See also --user.
--mail-auth
(SMTP) Specify a single address. This is used to specify the au?
thentication address (identity) of a submitted message that is
being relayed to another server.
If --mail-auth is provided several times, the last set value is
used.
Example:
curl --mail-auth user@example.com -T mail smtp://example.com/
See also --mail-rcpt and --mail-from.
--mail-from
(SMTP) Specify a single address that the given mail should get
sent from.
If --mail-from is provided several times, the last set value is
used.
Example:
curl --mail-from user@example.com -T mail smtp://example.com/
See also --mail-rcpt and --mail-auth.
--mail-rcpt
(SMTP) Specify a single email address, username or mailing list
name. Repeat this option several times to send to multiple recip?
ients.
When performing an address verification (VRFY command), the re?
cipient should be specified as the username or username and do?
main (as per Section 3.5 of RFC 5321).
When performing a mailing list expand (EXPN command), the recipi?
ent should be specified using the mailing list name, such as
"Friends" or "London-Office".
--mail-rcpt can be used several times in a command line
Example:
curl --mail-rcpt user@example.net smtp://example.com
See also --mail-rcpt-allowfails.
--mail-rcpt-allowfails
(SMTP) When sending data to multiple recipients, by default curl
aborts SMTP conversation if at least one of the recipients causes
RCPT TO command to return an error.
The default behavior can be changed by passing --mail-rcpt-allow?
fails command-line option which makes curl ignore errors and pro?
ceed with the remaining valid recipients.
If all recipients trigger RCPT TO failures and this flag is spec?
ified, curl still aborts the SMTP conversation and returns the
error received from to the last RCPT TO command.
Providing --mail-rcpt-allowfails multiple times has no extra ef?
fect. Disable it again with --no-mail-rcpt-allowfails.
Example:
curl --mail-rcpt-allowfails --mail-rcpt dest@example.com smtp://example.com
Added in 7.69.0. See also --mail-rcpt.
-M, --manual
Manual. Display the huge help text.
Example:
curl --manual
See also --verbose, --libcurl and --trace.
--max-filesize
(FTP HTTP MQTT) When set to a non-zero value, it specifies the
maximum size (in bytes) of a file to download. If the file re?
quested is larger than this value, the transfer does not start
and curl returns with exit code 63.
Setting the maximum value to zero disables the limit.
A size modifier may be used. For example, Appending 'k' or 'K'
counts the number as kilobytes, 'm' or 'M' makes it megabytes,
while 'g' or 'G' makes it gigabytes. Examples: 200K, 3m and 1G.
NOTE: before curl 8.4.0, when the file size is not known prior to
download, for such files this option has no effect even if the
file transfer ends up being larger than this given limit.
Starting with curl 8.4.0, this option aborts the transfer if it
reaches the threshold during transfer.
If --max-filesize is provided several times, the last set value
is used.
Example:
curl --max-filesize 100K https://example.com
See also --limit-rate.
--max-redirs
(HTTP) Set the maximum number of redirections to follow. When
--location or --follow are used, this option prevents curl from
following too many redirects. By default the limit is set to 50
redirects. Set this option to -1 to make it unlimited.
If --max-redirs is provided several times, the last set value is
used.
Example:
curl --max-redirs 3 --location https://example.com
See also --location and --follow.
-m, --max-time
Set the maximum time in seconds that you allow each transfer to
take. Prevents your batch jobs from hanging for hours due to slow
networks or links going down. This option accepts decimal values.
If you enable retrying the transfer (--retry) then the maximum
time counter is reset each time the transfer is retried. You can
use --retry-max-time to limit the retry time.
The decimal value needs to be provided using a dot (.) as decimal
separator - not the local version even if it might be using an?
other separator.
If --max-time is provided several times, the last set value is
used.
Examples:
curl --max-time 10 https://example.com
curl --max-time 2.92 https://example.com
See also --connect-timeout and --retry-max-time.
--metalink
This option was previously used to specify a Metalink resource.
Metalink support is disabled in curl for security reasons (added
in 7.78.0).
If --metalink is provided several times, the last set value is
used.
Example:
curl --metalink file https://example.com
See also --parallel.
--mptcp
Enable the use of Multipath TCP (MPTCP) for connections. MPTCP is
an extension to the standard TCP that allows multiple TCP streams
over different network paths between the same source and destina?
tion. This can enhance bandwidth and improve reliability by using
multiple paths simultaneously.
MPTCP is beneficial in networks where multiple paths exist be?
tween clients and servers, such as mobile networks where a device
may switch between WiFi and cellular data or in wired networks
with multiple Internet Service Providers.
This option is currently only supported on Linux starting from
kernel 5.6. Only TCP connections are modified, hence this option
does not affect HTTP/3 (QUIC) or UDP connections.
The server curl connects to must also support MPTCP. If not, the
connection seamlessly falls back to TCP.
Providing --mptcp multiple times has no extra effect. Disable it
again with --no-mptcp.
Example:
curl --mptcp https://example.com
Added in 8.9.0. See also --tcp-fastopen.
--negotiate
(HTTP) Enable Negotiate (SPNEGO) authentication.
This option requires a library built with GSS-API or SSPI sup?
port. Use --version to see if your curl supports GSS-API/SSPI or
SPNEGO.
When using this option, you must also provide a fake --user op?
tion to activate the authentication code properly. Sending a '-u
:' is enough as the username and password from the --user option
are not actually used.
Providing --negotiate multiple times has no extra effect. Dis?
able it again with --no-negotiate.
Example:
curl --negotiate -u : https://example.com
See also --basic, --ntlm, --anyauth and --proxy-negotiate.
-n, --netrc
Make curl scan the .netrc file in the user's home directory for
login name and password. This is typically used for FTP on Unix.
If used with HTTP, curl enables user authentication. See netrc(5)
and ftp(1) for details on the file format. curl does not complain
if that file does not have the right permissions (it should be
neither world- nor group-readable). The environment variable
"HOME" is used to find the home directory. If the "NETRC" envi?
ronment variable is set, that filename is used as the netrc file.
(Added in 8.16.0)
If --netrc-file is used, that overrides all other ways to figure
out the file.
The netrc file provides credentials for a hostname independent of
which protocol and port number that are used.
On Windows two filenames in the home directory are checked:
.netrc and _netrc, preferring the former. Older versions on Win?
dows checked for _netrc only.
A quick and simple example of how to setup a .netrc to allow curl
to FTP to the machine host.example.com with username 'myself' and
password 'secret' could look similar to:
machine host.example.com
login myself
password secret
Providing --netrc multiple times has no extra effect. Disable it
again with --no-netrc.
Example:
curl --netrc https://example.com
This option is mutually exclusive with --netrc-file and
--netrc-optional. See also --netrc-file, --config and --user.
--netrc-file
Set the netrc file to use. Similar to --netrc, except that you
also provide the path (absolute or relative).
It abides by --netrc-optional if specified.
If --netrc-file is provided several times, the last set value is
used.
Example:
curl --netrc-file netrc https://example.com
This option is mutually exclusive with --netrc. See also
--netrc, --user and --config.
--netrc-optional
Similar to --netrc, but this option makes the .netrc usage op?
tional and not mandatory as the --netrc option does.
Providing --netrc-optional multiple times has no extra effect.
Disable it again with --no-netrc-optional.
Example:
curl --netrc-optional https://example.com
This option is mutually exclusive with --netrc. See also
--netrc-file.
-:, --next
Use a separate operation for the following URL and associated op?
tions. This allows you to send several URL requests, each with
their own specific options, for example, such as different user?
names or custom requests for each.
--next resets all local options and only global ones have their
values survive over to the operation following the --next in?
struction. Global options include --verbose, --trace,
--trace-ascii and --fail-early.
For example, you can do both a GET and a POST in a single command
line:
curl www1.example.com --next -d postthis www2.example.com
--next can be used several times in a command line
Examples:
curl https://example.com --next -d postthis www2.example.com
curl -I https://example.com --next https://example.net/
See also --parallel and --config.
--no-alpn
(HTTPS) Disable the ALPN TLS extension. ALPN is enabled by de?
fault if libcurl was built with an SSL library that supports
ALPN. ALPN is used by a libcurl that supports HTTP/2 to negotiate
HTTP/2 support with the server during https sessions.
Note that this is the negated option name documented. You can use
--alpn to enable ALPN.
Providing --no-alpn multiple times has no extra effect. Disable
it again with --alpn.
Example:
curl --no-alpn https://example.com
For --no-alpn to work, it requires that the underlying libcurl is
built to support TLS. See also --no-npn and --http2.
-N, --no-buffer
Disable the buffering of the output stream. In normal work situa?
tions, curl uses a standard buffered output stream that has the
effect that it outputs the data in chunks, not necessarily ex?
actly when the data arrives. Using this option disables that
buffering.
Note that this is the negated option name documented. You can use
--buffer to enable buffering again.
Providing --no-buffer multiple times has no extra effect. Dis?
able it again with --buffer.
Example:
curl --no-buffer https://example.com
See also --progress-bar.
--no-clobber
When used in conjunction with the --output, --remote-header-name,
--remote-name, or --remote-name-all options, curl avoids over?
writing files that already exist. Instead, a dot and a number
gets appended to the name of the file that would be created, up
to filename.100 after which it does not create any file.
Note that this is the negated option name documented. You can
thus use --clobber to enforce the clobbering, even if --re?
mote-header-name is specified.
The --continue-at option cannot be used together with --no-clob?
ber.
Providing --no-clobber multiple times has no extra effect. Dis?
able it again with --clobber.
Example:
curl --no-clobber --output local/dir/file https://example.com
Added in 7.83.0. See also --output and --remote-name.
--no-keepalive
Disable the use of keepalive messages on the TCP connection. curl
otherwise enables them by default.
Note that this is the negated option name documented. You can
thus use --keepalive to enforce keepalive.
Providing --no-keepalive multiple times has no extra effect.
Disable it again with --keepalive.
Example:
curl --no-keepalive https://example.com
See also --keepalive-time and --keepalive-cnt.
--no-npn
(HTTPS) curl never uses NPN, this option has no effect (added in
7.86.0).
Disable the NPN TLS extension. NPN is enabled by default if
libcurl was built with an SSL library that supports NPN. NPN is
used by a libcurl that supports HTTP/2 to negotiate HTTP/2 sup?
port with the server during https sessions.
Providing --no-npn multiple times has no extra effect. Disable
it again with --npn.
Example:
curl --no-npn https://example.com
For --no-npn to work, it requires that the underlying libcurl is
built to support TLS. See also --no-alpn and --http2.
--no-progress-meter
Option to switch off the progress meter output without muting or
otherwise affecting warning and informational messages like
--silent does.
Note that this is the negated option name documented. You can
thus use --progress-meter to enable the progress meter again.
Providing --no-progress-meter multiple times has no extra effect.
Disable it again with --progress-meter.
Example:
curl --no-progress-meter -o store https://example.com
Added in 7.67.0. See also --verbose and --silent.
--no-sessionid
(TLS) Disable curl's use of SSL session-ID caching. By default
all transfers are done using the cache. Note that while nothing
should ever get hurt by attempting to reuse SSL session-IDs,
there seem to be broken SSL implementations in the wild that may
require you to disable this in order for you to succeed.
Note that this is the negated option name documented. You can
thus use --sessionid to enforce session-ID caching.
Providing --no-sessionid multiple times has no extra effect.
Disable it again with --sessionid.
Example:
curl --no-sessionid https://example.com
See also --insecure.
--noproxy
Comma-separated list of hosts for which not to use a proxy, if
one is specified. The only wildcard is a single "*" character,
which matches all hosts, and effectively disables the proxy. Each
name in this list is matched as either a domain which contains
the hostname, or the hostname itself. For example, "local.com"
would match "local.com", "local.com:80", and "www.local.com", but
not "www.notlocal.com".
This option overrides the environment variables that disable the
proxy ("no_proxy" and "NO_PROXY"). If there is an environment
variable disabling a proxy, you can set the no proxy list to ""
to override it.
IP addresses specified to this option can be provided using CIDR
notation (added in 7.86.0): an appended slash and number speci?
fies the number of network bits out of the address to use in the
comparison. For example "192.168.0.0/16" would match all ad?
dresses starting with "192.168".
If --noproxy is provided several times, the last set value is
used.
Example:
curl --noproxy "www.example" https://example.com
See also --proxy.
--ntlm (HTTP) Use NTLM authentication. The NTLM authentication method
was designed by Microsoft and is used by IIS web servers. It is a
proprietary protocol, reverse-engineered by clever people and im?
plemented in curl based on their efforts. This kind of behavior
should not be endorsed, you should encourage everyone who uses
NTLM to switch to a public and documented authentication method
instead, such as Digest.
If you want to enable NTLM for your proxy authentication, then
use --proxy-ntlm.
Providing --ntlm multiple times has no extra effect. Disable it
again with --no-ntlm.
Example:
curl --ntlm -u user:password https://example.com
For --ntlm to work, it requires that the underlying libcurl is
built to support TLS. See also --proxy-ntlm.
--ntlm-wb
(HTTP) Deprecated option (added in 8.8.0).
Enabled NTLM much in the style --ntlm does, but handed over the
authentication to a separate executable that was executed when
needed.
Providing --ntlm-wb multiple times has no extra effect.
Example:
curl --ntlm-wb -u user:password https://example.com
See also --ntlm and --proxy-ntlm.
--oauth2-bearer
(IMAP LDAP POP3 SMTP HTTP) Specify the Bearer Token for OAUTH 2.0
server authentication. The Bearer Token is used in conjunction
with the username which can be specified as part of the --url or
--user options.
The Bearer Token and username are formatted according to RFC
6750.
If --oauth2-bearer is provided several times, the last set value
is used.
Example:
curl --oauth2-bearer "mF_9.B5f-4.1JqM" https://example.com
See also --basic, --ntlm and --digest.
--out-null
Discard all response output of a transfer silently. This is the
more efficient and portable version of
curl https://host.example -o /dev/null
The transfer is done in full, all data is received and checked,
but the bytes are not written anywhere.
--out-null is associated with a single URL. Use it once per URL
when you use several URLs in a command line.
Example:
curl "https://example.com" --out-null
Added in 8.16.0. See also --output, --remote-name, --re?
mote-name-all and --remote-header-name.
-o, --output
Write output to the given file instead of stdout. If you are us?
ing globbing to fetch multiple documents, you should quote the
URL and you can use "#" followed by a number in the filename.
That variable is then replaced with the current string for the
URL being fetched. Like in:
curl "http://{one,two}.example.com" -o "file_#1.txt"
or use several variables like:
curl "http://{site,host}.host[1-5].example" -o "#1_#2"
You may use this option as many times as the number of URLs you
have. For example, if you specify two URLs on the same command
line, you can use it like this:
curl -o aa example.com -o bb example.net
and the order of the -o options and the URLs does not matter,
just that the first -o is for the first URL and so on, so the
above command line can also be written as
curl example.com example.net -o aa -o bb
See also the --create-dirs option to create the local directories
dynamically. Specifying the output as '-' (a single dash) passes
the output to stdout.
To suppress response bodies, you can redirect output to
/dev/null:
curl example.com -o /dev/null
Or for Windows:
curl example.com -o nul
Or, even more efficient and portable, use
curl example.com --out-null
Specify the filename as single minus to force the output to std?
out, to override curl's internal binary output in terminal pre?
vention:
curl https://example.com/jpeg -o -
Note that the binary output may be caused by the response being
compressed, in which case you may want to use the --compressed
option.
--output is associated with a single URL. Use it once per URL
when you use several URLs in a command line.
Examples:
curl -o file https://example.com
curl "http://{one,two}.example.com" -o "file_#1.txt"
curl "http://{site,host}.host[1-5].example" -o "#1_#2"
curl -o file https://example.com -o file2 https://example.net
See also --out-null, --remote-name, --remote-name-all, --re?
mote-header-name and --compressed.
--output-dir
Specify the directory in which files should be stored, when --re?
mote-name or --output are used.
The given output directory is used for all URLs and output op?
tions on the command line, up until the first --next.
If the specified target directory does not exist, the operation
fails unless --create-dirs is also used.
If --output-dir is provided several times, the last set value is
used.
Example:
curl --output-dir "tmp" -O https://example.com
Added in 7.73.0. See also --remote-name and --remote-header-name.
-Z, --parallel
Make curl perform all transfers in parallel as compared to the
regular serial manner. Parallel transfer means that curl runs up
to N concurrent transfers simultaneously and if there are more
than N transfers to handle, it starts new ones when earlier
transfers finish.
With parallel transfers, the progress meter output is different
from when doing serial transfers, as it then displays the trans?
fer status for multiple transfers in a single line.
The maximum amount of concurrent transfers is set with --paral?
lel-max and it defaults to 50.
This option is global and does not need to be specified for each
use of --next.
Providing --parallel multiple times has no extra effect. Disable
it again with --no-parallel.
Example:
curl --parallel https://example.com -o file1 https://example.com -o file2
Added in 7.66.0. See also --next, --verbose, --parallel-max and
--parallel-immediate.
--parallel-immediate
When doing parallel transfers, this option instructs curl to pre?
fer opening up more connections in parallel at once rather than
waiting to see if new transfers can be added as multiplexed
streams on another connection.
By default, without this option set, curl prefers to wait a lit?
tle and multiplex new transfers over existing connections. It
keeps the number of connections low at the expense of risking a
slightly slower transfer startup.
This option is global and does not need to be specified for each
use of --next.
Providing --parallel-immediate multiple times has no extra ef?
fect. Disable it again with --no-parallel-immediate.
Example:
curl --parallel-immediate -Z https://example.com -o file1 https://example.com -o file2
Added in 7.68.0. See also --parallel and --parallel-max.
--parallel-max
When asked to do parallel transfers, using --parallel, this op?
tion controls the maximum amount of transfers to do simultane?
ously.
The default is 50. 65535 is the largest supported value.
This option is global and does not need to be specified for each
use of --next.
If --parallel-max is provided several times, the last set value
is used.
Example:
curl --parallel-max 100 -Z https://example.com ftp://example.com/
Added in 7.66.0. See also --parallel and --parallel-max-host.
--parallel-max-host
When asked to do parallel transfers, using --parallel, this op?
tion controls the maximum amount of concurrent connections curl
is allowed to do to the same protocol + hostname + port number
target.
The limit is enforced by libcurl and queued "internally", which
means that transfers that are waiting for an available connection
still look like started transfers in the progress meter.
The default is 0 (unlimited). 65535 is the largest supported
value.
This option is global and does not need to be specified for each
use of --next.
If --parallel-max-host is provided several times, the last set
value is used.
Example:
curl --parallel-max-host 5 -Z https://example.com ftp://example.com/
Added in 8.16.0. See also --parallel and --parallel-max.
--pass
(TLS SCP SFTP) Passphrase for the private key used for SSH or
TLS.
If --pass is provided several times, the last set value is used.
Example:
curl --pass secret --key file https://example.com
See also --key and --user.
--path-as-is
Do not handle sequences of /../ or /./ in the given URL path.
Normally curl squashes or merges them according to standards but
with this option set you tell it not to do that.
Providing --path-as-is multiple times has no extra effect. Dis?
able it again with --no-path-as-is.
Example:
curl --path-as-is https://example.com/../../etc/passwd
See also --request-target.
--pinnedpubkey
(TLS) Use the specified public key file (or hashes) to verify the
peer. This can be a path to a file which contains a single public
key in PEM or DER format, or any number of base64 encoded sha256
hashes preceded by 'sha256//' and separated by ';'.
When negotiating a TLS or SSL connection, the server sends a cer?
tificate indicating its identity. A public key is extracted from
this certificate and if it does not exactly match the public key
provided to this option, curl aborts the connection before send?
ing or receiving any data.
This option is independent of option --insecure. If you use both
options together then the peer is still verified by public key.
PEM/DER support:
OpenSSL and GnuTLS, wolfSSL, mbedTLS, Schannel
sha256 support:
OpenSSL, GnuTLS and wolfSSL, mbedTLS, Schannel
Other SSL backends not supported.
If --pinnedpubkey is provided several times, the last set value
is used.
Examples:
curl --pinnedpubkey keyfile https://example.com
curl --pinnedpubkey 'sha256//ce118b51897f4452dc' https://example.com
See also --hostpubsha256.
--post301
(HTTP) Respect RFC 7231/6.4.2 and do not convert POST requests
into GET requests when following a 301 redirect. The non-RFC be?
havior is ubiquitous in web browsers, so curl does the conversion
by default to maintain consistency. However, a server may require
a POST to remain a POST after such a redirection. This option is
meaningful only when using --location.
Providing --post301 multiple times has no extra effect. Disable
it again with --no-post301.
Example:
curl --post301 --location -d "data" https://example.com
See also --post302, --post303 and --location.
--post302
(HTTP) Respect RFC 7231/6.4.3 and do not convert POST requests
into GET requests when following a 302 redirect. The non-RFC be?
havior is ubiquitous in web browsers, so curl does the conversion
by default to maintain consistency. However, a server may require
a POST to remain a POST after such a redirection. This option is
meaningful only when using --location.
Providing --post302 multiple times has no extra effect. Disable
it again with --no-post302.
Example:
curl --post302 --location -d "data" https://example.com
See also --post301, --post303 and --location.
--post303
(HTTP) Violate RFC 7231/6.4.4 and do not convert POST requests
into GET requests when following 303 redirect. A server may re?
quire a POST to remain a POST after a 303 redirection. This op?
tion is meaningful only when using --location.
Providing --post303 multiple times has no extra effect. Disable
it again with --no-post303.
Example:
curl --post303 --location -d "data" https://example.com
See also --post302, --post301 and --location.
--preproxy <[protocol://]host[:port]>
Use the specified SOCKS proxy before connecting to an HTTP or
HTTPS --proxy. In such a case curl first connects to the SOCKS
proxy and then connects (through SOCKS) to the HTTP or HTTPS
proxy. Hence pre proxy.
The pre proxy string should be specified with a protocol:// pre?
fix to specify alternative proxy protocols. Use socks4://,
socks4a://, socks5:// or socks5h:// to request the specific SOCKS
version to be used. No protocol specified makes curl default to
SOCKS4.
If the port number is not specified in the proxy string, it is
assumed to be 1080.
User and password that might be provided in the proxy string are
URL decoded by curl. This allows you to pass in special charac?
ters such as @ by using %40 or pass in a colon with %3a.
If --preproxy is provided several times, the last set value is
used.
Example:
curl --preproxy socks5://proxy.example -x http://http.example https://example.com
See also --proxy and --socks5.
-#, --progress-bar
Make curl display transfer progress as a simple progress bar in?
stead of the standard, more informational, meter.
This progress bar draws a single line of '#' characters across
the screen and shows a percentage if the transfer size is known.
For transfers without a known size, there is a space ship (-=o=-)
that moves back and forth but only while data is being trans?
ferred, with a set of flying hash sign symbols on top.
This option is global and does not need to be specified for each
use of --next.
Providing --progress-bar multiple times has no extra effect.
Disable it again with --no-progress-bar.
Example:
curl -# -O https://example.com
See also --styled-output.
--proto
Limit what protocols to allow for transfers. Protocols are evalu?
ated left to right, are comma separated, and are each a protocol
name or 'all', optionally prefixed by zero or more modifiers.
Available modifiers are:
+ Permit this protocol in addition to protocols already per?
mitted (this is the default if no modifier is used).
- Deny this protocol, removing it from the list of protocols
already permitted.
= Permit only this protocol (ignoring the list already per?
mitted), though subject to later modification by subse?
quent entries in the comma separated list.
For example: --proto -ftps uses the default protocols, but dis?
ables ftps
--proto -all,https,+http only enables http and https
--proto =http,https also only enables http and https
Unknown and disabled protocols produce a warning. This allows
scripts to safely rely on being able to disable potentially dan?
gerous protocols, without relying upon support for that protocol
being built into curl to avoid an error.
This option can be used multiple times, in which case the effect
is the same as concatenating the protocols into one instance of
the option.
If --proto is provided several times, the last set value is used.
Example:
curl --proto =http,https,sftp https://example.com
See also --proto-redir and --proto-default.
--proto-default
Use protocol for any provided URL missing a scheme.
An unknown or unsupported protocol causes error CURLE_UNSUP?
PORTED_PROTOCOL.
This option does not change the default proxy protocol (http).
Without this option set, curl guesses protocol based on the host?
name, see --url for details.
If --proto-default is provided several times, the last set value
is used.
Example:
curl --proto-default https ftp.example.com
See also --proto and --proto-redir.
--proto-redir
Limit what protocols to allow on redirects. Protocols denied by
--proto are not overridden by this option. See --proto for how
protocols are represented.
Example, allow only HTTP and HTTPS on redirect:
curl --proto-redir -all,http,https --follow http://example.com
By default curl only allows HTTP, HTTPS, FTP and FTPS on redi?
rects . Specifying all or +all enables all protocols on redi?
rects, which is not good for security.
If --proto-redir is provided several times, the last set value is
used.
Example:
curl --proto-redir =http,https --follow https://example.com
See also --proto and --follow.
-x, --proxy <[protocol://]host[:port]>
Use the specified proxy.
The proxy string can be specified with a protocol:// prefix. No
protocol specified or http:// it is treated as an HTTP proxy. Use
socks4://, socks4a://, socks5:// or socks5h:// to request a spe?
cific SOCKS version to be used.
Unix domain sockets are supported for socks proxy. Set localhost
for the host part. e.g. socks5h://localhost/path/to/socket.sock
HTTPS proxy support works with the https:// protocol prefix for
OpenSSL and GnuTLS. It also works for mbedTLS, Rustls, Schannel
and wolfSSL (added in 7.87.0).
Unrecognized and unsupported proxy protocol schemes cause an er?
ror.
If the port number is not specified in the proxy string, it is
assumed to be 1080.
This option overrides existing environment variables that set the
proxy to use. If there is an environment variable setting a
proxy, you can set proxy to "" to override it.
All operations that are performed over an HTTP proxy are trans?
parently converted to HTTP. It means that certain protocol spe?
cific operations might not be available. This is not the case if
you can tunnel through the proxy, as one with the --proxytunnel
option.
User and password that might be provided in the proxy string are
URL decoded by curl. This allows you to pass in special charac?
ters such as @ by using %40 or pass in a colon with %3a.
The proxy host can be specified the same way as the proxy envi?
ronment variables, including the protocol prefix (http://) and
the embedded user + password.
When a proxy is used, the active FTP mode as set with --ftp-port,
cannot be used.
Doing FTP over an HTTP proxy without --proxytunnel makes curl do
HTTP with an FTP URL over the proxy. For such transfers, common
FTP specific options do not work, including --ssl-reqd and
--ftp-ssl-control.
If --proxy is provided several times, the last set value is used.
Example:
curl --proxy http://proxy.example https://example.com
See also --socks5 and --proxy-basic.
--proxy-anyauth
Automatically pick a suitable authentication method when communi?
cating with the given HTTP proxy. This might cause an extra re?
quest/response round-trip.
Example:
curl --proxy-anyauth --proxy-user user:passwd -x proxy https://example.com
See also --proxy, --proxy-basic and --proxy-digest.
--proxy-basic
Use HTTP Basic authentication when communicating with the given
proxy. Use --basic for enabling HTTP Basic with a remote host.
Basic is the default authentication method curl uses with prox?
ies.
Providing --proxy-basic multiple times has no extra effect. Dis?
able it again with --no-proxy-basic.
Example:
curl --proxy-basic --proxy-user user:passwd -x proxy https://example.com
See also --proxy, --proxy-anyauth and --proxy-digest.
--proxy-ca-native
(TLS) Use the operating system's native CA store for certificate
verification of the HTTPS proxy.
This option is independent of other HTTPS proxy CA certificate
locations set at run time or build time. Those locations are
searched in addition to the native CA store.
Equivalent to --ca-native but used in HTTPS proxy context. Refer
to --ca-native for TLS backend limitations.
Providing --proxy-ca-native multiple times has no extra effect.
Disable it again with --no-proxy-ca-native.
Example:
curl --proxy-ca-native https://example.com
Added in 8.2.0. See also --ca-native, --cacert, --capath,
--dump-ca-embed and --insecure.
--proxy-cacert
Use the specified certificate file to verify the HTTPS proxy. The
file may contain multiple CA certificates. The certificate(s)
must be in PEM format.
This allows you to use a different trust for the proxy compared
to the remote server connected to via the proxy.
Equivalent to --cacert but used in HTTPS proxy context.
If --proxy-cacert is provided several times, the last set value
is used.
Example:
curl --proxy-cacert CA-file.txt -x https://proxy.example https://example.com
See also --proxy-capath, --cacert, --capath, --dump-ca-embed and
--proxy.
--proxy-capath
Same as --capath but used in HTTPS proxy context.
Use the specified certificate directory to verify the proxy. Mul?
tiple paths can be provided by separating them with colon (":")
(e.g. "path1:path2:path3"). The certificates must be in PEM for?
mat, and if curl is built against OpenSSL, the directory must
have been processed using the c_rehash utility supplied with
OpenSSL. Using --proxy-capath can allow OpenSSL-powered curl to
make SSL-connections much more efficiently than using
--proxy-cacert if the --proxy-cacert file contains many CA cer?
tificates.
If this option is set, the default capath value is ignored.
If --proxy-capath is provided several times, the last set value
is used.
Example:
curl --proxy-capath /local/directory -x https://proxy.example https://example.com
See also --proxy-cacert, --proxy, --capath and --dump-ca-embed.
--proxy-cert
Use the specified client certificate file when communicating with
an HTTPS proxy. The certificate must be PEM format. If the op?
tional password is not specified, it is queried for on the termi?
nal. Use --proxy-key to provide the private key.
This option is the equivalent to --cert but used in HTTPS proxy
context.
If --proxy-cert is provided several times, the last set value is
used.
Example:
curl --proxy-cert file -x https://proxy.example https://example.com
See also --proxy, --proxy-key and --proxy-cert-type.
--proxy-cert-type
Set type of the provided client certificate when using HTTPS
proxy. PEM, DER, ENG, PROV and P12 are recognized types.
The default type depends on the TLS backend and is usually PEM.
For Schannel it is P12. If --proxy-cert is a pkcs11: URI then ENG
or PROV is the default type (depending on OpenSSL version).
Equivalent to --cert-type but used in HTTPS proxy context.
If --proxy-cert-type is provided several times, the last set
value is used.
Example:
curl --proxy-cert-type PEM --proxy-cert file -x https://proxy.example https://example.com
See also --proxy-cert and --proxy-key.
--proxy-ciphers
(TLS) Same as --ciphers but used in HTTPS proxy context.
Specify which cipher suites to use in the connection to your
HTTPS proxy when it negotiates TLS 1.2 (1.1, 1.0). The list of
ciphers suites must specify valid ciphers. Read up on cipher
suite details on this URL:
https://curl.se/docs/ssl-ciphers.html
If --proxy-ciphers is provided several times, the last set value
is used.
Example:
curl --proxy-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256 -x https://proxy.example https://example.com
See also --proxy-tls13-ciphers, --ciphers and --proxy.
--proxy-crlfile
Provide filename for a PEM formatted file with a Certificate Re?
vocation List that specifies peer certificates that are consid?
ered revoked when communicating with an HTTPS proxy.
Equivalent to --crlfile but only used in HTTPS proxy context.
If --proxy-crlfile is provided several times, the last set value
is used.
Example:
curl --proxy-crlfile rejects.txt -x https://proxy.example https://example.com
See also --crlfile and --proxy.
--proxy-digest
Use HTTP Digest authentication when communicating with the given
proxy. Use --digest for enabling HTTP Digest with a remote host.
Providing --proxy-digest multiple times has no extra effect.
Disable it again with --no-proxy-digest.
Example:
curl --proxy-digest --proxy-user user:passwd -x proxy https://example.com
See also --proxy, --proxy-anyauth and --proxy-basic.
--proxy-header
(HTTP) Extra header to include in the request when sending HTTP
to a proxy. You may specify any number of extra headers. This is
the equivalent option to --header but is for proxy communication
only like in CONNECT requests when you want a separate header
sent to the proxy to what is sent to the actual remote host.
curl makes sure that each header you add/replace is sent with the
proper end-of-line marker, you should thus not add that as a part
of the header content: do not add newlines or carriage returns,
they only mess things up for you.
Headers specified with this option are not included in requests
that curl knows are not to be sent to a proxy.
This option can take an argument in @filename style, which then
adds a header for each line in the input file. Using @- makes
curl read the headers from stdin.
This option can be used multiple times to add/replace/remove mul?
tiple headers.
--proxy-header can be used several times in a command line
Examples:
curl --proxy-header "X-First-Name: Joe" -x http://proxy https://example.com
curl --proxy-header "User-Agent: surprise" -x http://proxy https://example.com
curl --proxy-header "Host:" -x http://proxy https://example.com
See also --proxy and --header.
--proxy-http2
(HTTP) Negotiate HTTP/2 with an HTTPS proxy. The proxy might
still only offer HTTP/1 and then curl sticks to using that ver?
sion.
This has no effect for any other kinds of proxies.
Providing --proxy-http2 multiple times has no extra effect. Dis?
able it again with --no-proxy-http2.
Example:
curl --proxy-http2 -x proxy https://example.com
For --proxy-http2 to work, it requires that the underlying
libcurl is built to support HTTP/2. Added in 8.1.0. See also
--proxy.
--proxy-insecure
Same as --insecure but used in HTTPS proxy context.
Every secure connection curl makes is verified to be secure be?
fore the transfer takes place. This option makes curl skip the
verification step with a proxy and proceed without checking.
When this option is not used for a proxy using HTTPS, curl veri?
fies the proxy's TLS certificate before it continues: that the
certificate contains the right name which matches the hostname
and that the certificate has been signed by a CA certificate
present in the cert store. See this online resource for further
details: https://curl.se/docs/sslcerts.html
WARNING: using this option makes the transfer to the proxy inse?
cure.
Providing --proxy-insecure multiple times has no extra effect.
Disable it again with --no-proxy-insecure.
Example:
curl --proxy-insecure -x https://proxy.example https://example.com
See also --proxy and --insecure.
--proxy-key
Specify the filename for your private key when using client cer?
tificates with your HTTPS proxy. This option is the equivalent to
--key but used in HTTPS proxy context.
If --proxy-key is provided several times, the last set value is
used.
Example:
curl --proxy-key here -x https://proxy.example https://example.com
See also --proxy-key-type and --proxy.
--proxy-key-type
Specify the private key file type your --proxy-key provided pri?
vate key uses. DER, PEM, and ENG are supported. If not speci?
fied, PEM is assumed.
Equivalent to --key-type but used in HTTPS proxy context.
If --proxy-key-type is provided several times, the last set value
is used.
Example:
curl --proxy-key-type DER --proxy-key here -x https://proxy.example https://example.com
See also --proxy-key and --proxy.
--proxy-negotiate
Use HTTP Negotiate (SPNEGO) authentication when communicating
with the given proxy. Use --negotiate for enabling HTTP Negotiate
(SPNEGO) with a remote host.
Providing --proxy-negotiate multiple times has no extra effect.
Example:
curl --proxy-negotiate --proxy-user user:passwd -x proxy https://example.com
See also --proxy-anyauth, --proxy-basic and --proxy-service-name.
--proxy-ntlm
Use HTTP NTLM authentication when communicating with the given
proxy. Use --ntlm for enabling NTLM with a remote host.
Providing --proxy-ntlm multiple times has no extra effect. Dis?
able it again with --no-proxy-ntlm.
Example:
curl --proxy-ntlm --proxy-user user:passwd -x http://proxy https://example.com
See also --proxy-negotiate, --proxy-anyauth and --proxy-user.
--proxy-pass
Passphrase for the private key for HTTPS proxy client certifi?
cate.
Equivalent to --pass but used in HTTPS proxy context.
If --proxy-pass is provided several times, the last set value is
used.
Example:
curl --proxy-pass secret --proxy-key here -x https://proxy.example https://example.com
See also --proxy and --proxy-key.
--proxy-pinnedpubkey
(TLS) Use the specified public key file (or hashes) to verify the
proxy. This can be a path to a file which contains a single pub?
lic key in PEM or DER format, or any number of base64 encoded
sha256 hashes preceded by 'sha256//' and separated by ';'.
When negotiating a TLS or SSL connection, the server sends a cer?
tificate indicating its identity. A public key is extracted from
this certificate and if it does not exactly match the public key
provided to this option, curl aborts the connection before send?
ing or receiving any data.
Before curl 8.10.0 this option did not work due to a bug.
If --proxy-pinnedpubkey is provided several times, the last set
value is used.
Examples:
curl --proxy-pinnedpubkey keyfile https://example.com
curl --proxy-pinnedpubkey 'sha256//ce118b51897f4452dc' https://example.com
See also --pinnedpubkey and --proxy.
--proxy-service-name
Set the service name for SPNEGO when doing proxy authentication.
If --proxy-service-name is provided several times, the last set
value is used.
Example:
curl --proxy-service-name "shrubbery" -x proxy https://example.com
See also --service-name, --proxy and --proxy-negotiate.
--proxy-ssl-allow-beast
Do not work around a security flaw in the TLS1.0 protocol known
as BEAST when communicating to an HTTPS proxy. If this option is
not used, the TLS layer may use workarounds known to cause inter?
operability problems with some older server implementations.
This option only changes how curl does TLS 1.0 with an HTTPS
proxy and has no effect on later TLS versions.
WARNING: this option loosens the TLS security, and by using this
flag you ask for exactly that.
Equivalent to --ssl-allow-beast but used in HTTPS proxy context.
Providing --proxy-ssl-allow-beast multiple times has no extra ef?
fect. Disable it again with --no-proxy-ssl-allow-beast.
Example:
curl --proxy-ssl-allow-beast -x https://proxy.example https://example.com
See also --ssl-allow-beast and --proxy.
--proxy-ssl-auto-client-cert
Same as --ssl-auto-client-cert but used in HTTPS proxy context.
This is only supported by Schannel.
Providing --proxy-ssl-auto-client-cert multiple times has no ex?
tra effect. Disable it again with --no-proxy-ssl-auto-client-
cert.
Example:
curl --proxy-ssl-auto-client-cert -x https://proxy.example https://example.com
Added in 7.77.0. See also --ssl-auto-client-cert and --proxy.
--proxy-tls13-ciphers
(TLS) Same as --tls13-ciphers but used in HTTPS proxy context.
Specify which cipher suites to use in the connection to your
HTTPS proxy when it negotiates TLS 1.3. The list of ciphers
suites must specify valid ciphers. Read up on TLS 1.3 cipher
suite details on this URL:
https://curl.se/docs/ssl-ciphers.html
This option is used when curl is built to use OpenSSL 1.1.1 or
later, Schannel, wolfSSL, or mbedTLS 3.6.0 or later.
Before curl 8.10.0 with mbedTLS or wolfSSL, TLS 1.3 cipher suites
were set by using the --proxy-ciphers option.
If --proxy-tls13-ciphers is provided several times, the last set
value is used.
Example:
curl --proxy-tls13-ciphers TLS_AES_128_GCM_SHA256 -x proxy https://example.com
See also --proxy-ciphers, --tls13-ciphers and --proxy.
--proxy-tlsauthtype
Set TLS authentication type with HTTPS proxy. The only supported
option is "SRP", for TLS-SRP (RFC 5054). This option works only
if the underlying libcurl is built with TLS-SRP support.
Equivalent to --tlsauthtype but used in HTTPS proxy context.
If --proxy-tlsauthtype is provided several times, the last set
value is used.
Example:
curl --proxy-tlsauthtype SRP -x https://proxy.example https://example.com
See also --proxy, --proxy-tlsuser and --proxy-tlspassword.
--proxy-tlspassword
Set password to use with the TLS authentication method specified
with --proxy-tlsauthtype when using HTTPS proxy. Requires that
--proxy-tlsuser is set.
This option does not work with TLS 1.3.
Equivalent to --tlspassword but used in HTTPS proxy context.
If --proxy-tlspassword is provided several times, the last set
value is used.
Example:
curl --proxy-tlspassword passwd -x https://proxy.example https://example.com
See also --proxy and --proxy-tlsuser.
--proxy-tlsuser
Set username for use for HTTPS proxy with the TLS authentication
method specified with --proxy-tlsauthtype. Requires that
--proxy-tlspassword also is set.
This option does not work with TLS 1.3.
If --proxy-tlsuser is provided several times, the last set value
is used.
Example:
curl --proxy-tlsuser smith -x https://proxy.example https://example.com
See also --proxy and --proxy-tlspassword.
--proxy-tlsv1
Use at least TLS version 1.x when negotiating with an HTTPS
proxy. That means TLS version 1.0 or higher
Equivalent to --tlsv1 but for an HTTPS proxy context.
Providing --proxy-tlsv1 multiple times has no extra effect.
Example:
curl --proxy-tlsv1 -x https://proxy.example https://example.com
See also --proxy.
-U, --proxy-user
Specify the username and password to use for proxy authentica?
tion.
If you use a Windows SSPI-enabled curl binary and do either Nego?
tiate or NTLM authentication then you can tell curl to select the
username and password from your environment by specifying a sin?
gle colon with this option: "-U :".
On systems where it works, curl hides the given option argument
from process listings. This is not enough to protect credentials
from possibly getting seen by other users on the same system as
they still are visible for a moment before being cleared. Such
sensitive data should be retrieved from a file instead or similar
and never used in clear text in a command line.
If --proxy-user is provided several times, the last set value is
used.
Example:
curl --proxy-user smith:secret -x proxy https://example.com
See also --proxy-pass.
--proxy1.0
Use the specified HTTP 1.0 proxy. If the port number is not spec?
ified, it is assumed at port 1080.
The only difference between this and the HTTP proxy option
--proxy, is that attempts to use CONNECT through the proxy speci?
fies an HTTP 1.0 protocol instead of the default HTTP 1.1.
Providing --proxy1.0 multiple times has no extra effect.
Example:
curl --proxy1.0 http://proxy https://example.com
See also --proxy, --socks5 and --preproxy.
-p, --proxytunnel
When an HTTP proxy is used --proxy, this option makes curl tunnel
the traffic through the proxy. The tunnel approach is made with
the HTTP proxy CONNECT request and requires that the proxy allows
direct connection to the remote port number curl wants to tunnel
through to.
To suppress proxy CONNECT response headers when curl is set to
output headers use --suppress-connect-headers.
Providing --proxytunnel multiple times has no extra effect. Dis?
able it again with --no-proxytunnel.
Example:
curl --proxytunnel -x http://proxy https://example.com
See also --proxy.
--pubkey
(SFTP SCP) Public key filename. Allows you to provide your public
key in this separate file.
curl attempts to automatically extract the public key from the
private key file, so passing this option is generally not re?
quired. Note that this public key extraction requires libcurl to
be linked against a copy of libssh2 1.2.8 or higher that is it?
self linked against OpenSSL.
If --pubkey is provided several times, the last set value is
used.
Example:
curl --pubkey file.pub sftp://example.com/
See also --pass.
-Q, --quote
(FTP SFTP) Send an arbitrary command to the remote FTP or SFTP
server. Quote commands are sent BEFORE the transfer takes place
(just after the initial PWD command in an FTP transfer, to be ex?
act). To make commands take place after a successful transfer,
prefix them with a dash '-'.
(FTP only) To make commands be sent after curl has changed the
working directory, just before the file transfer command(s), pre?
fix the command with a '+'.
You may specify any number of commands.
By default curl stops at first failure. To make curl continue
even if the command fails, prefix the command with an asterisk
(*). Otherwise, if the server returns failure for one of the com?
mands, the entire operation is aborted.
You must send syntactically correct FTP commands as RFC 959 de?
fines to FTP servers, or one of the commands listed below to SFTP
servers.
SFTP is a binary protocol. Unlike for FTP, curl interprets SFTP
quote commands itself before sending them to the server. File?
names must be provided within double quotes to embed spaces,
backslashes, quotes or double quotes. Within double quotes the
following escape sequences are available for that purpose: \\,
\", and \'.
Following is the list of all supported SFTP quote commands:
atime date file
The atime command sets the last access time of the file
named by the file operand. The date expression can be all
sorts of date strings, see the curl_getdate(3) man page
for date expression details. (Added in 7.73.0)
chgrp group file
The chgrp command sets the group ID of the file named by
the file operand to the group ID specified by the group
operand. The group operand is a decimal integer group ID.
chmod mode file
The chmod command modifies the file mode bits of the spec?
ified file. The mode operand is an octal integer mode num?
ber.
chown user file
The chown command sets the owner of the file named by the
file operand to the user ID specified by the user operand.
The user operand is a decimal integer user ID.
ln source_file target_file
The ln and symlink commands create a symbolic link at the
target_file location pointing to the source_file location.
mkdir directory_name
The mkdir command creates the directory named by the di?
rectory_name operand.
mtime date file
The mtime command sets the last modification time of the
file named by the file operand. The date expression can be
all sorts of date strings, see the curl_getdate(3) man
page for date expression details. (Added in 7.73.0)
pwd The pwd command returns the absolute path name of the cur?
rent working directory.
rename source target
The rename command renames the file or directory named by
the source operand to the destination path named by the
target operand.
rm file
The rm command removes the file specified by the file
operand.
rmdir directory
The rmdir command removes the directory entry specified by
the directory operand, provided it is empty.
symlink source_file target_file
See ln.
--quote can be used several times in a command line
Example:
curl --quote "DELE file" ftp://example.com/foo
See also --request.
--random-file
Deprecated option. This option is ignored (added in 7.84.0).
Prior to that it only had an effect on curl if built to use old
versions of OpenSSL.
Specify the path name to file containing random data. The data
may be used to seed the random engine for SSL connections.
If --random-file is provided several times, the last set value is
used.
Example:
curl --random-file rubbish https://example.com
See also --egd-file.
-r, --range
(HTTP FTP SFTP FILE) Retrieve a byte range (i.e. a partial docu?
ment) from an HTTP/1.1, FTP or SFTP server or a local FILE.
Ranges can be specified in a number of ways.
0-499 specifies the first 500 bytes
500-999
specifies the second 500 bytes
-500 specifies the last 500 bytes
9500- specifies the bytes from offset 9500 and forward
0-0,-1 specifies the first and last byte only(*)(HTTP)
100-199,500-599
specifies two separate 100-byte ranges(*) (HTTP)
(*) = NOTE that if specifying multiple ranges and the server sup?
ports it then it replies with a multiple part response that curl
returns as-is. It contains meta information in addition to the
requested bytes. Parsing or otherwise transforming this response
is the responsibility of the caller.
Only digit characters (0-9) are valid in the 'start' and 'stop'
fields of the 'start-stop' range syntax. If a non-digit character
is given in the range, the server's response is unspecified, de?
pending on the server's configuration.
Many HTTP/1.1 servers do not have this feature enabled, so that
when you attempt to get a range, curl instead gets the whole doc?
ument.
FTP and SFTP range downloads only support the simple 'start-stop'
syntax (optionally with one of the numbers omitted). FTP use de?
pends on the extended FTP command SIZE.
When using this option for HTTP uploads using POST or PUT, func?
tionality is not guaranteed. The HTTP protocol has no standard
interoperable resume upload and curl uses a set of headers for
this purpose that once proved working for some servers and have
been left for those who find that useful.
This command line option is mutually exclusive with --con?
tinue-at: you can only use one of them for a single transfer.
If --range is provided several times, the last set value is used.
Example:
curl --range 22-44 https://example.com
See also --continue-at and --append.
--rate
Specify the maximum transfer frequency you allow curl to use - in
number of transfer starts per time unit (sometimes called request
rate). Without this option, curl starts the next transfer as fast
as possible.
If given several URLs and a transfer completes faster than the
allowed rate, curl waits until the next transfer is started to
maintain the requested rate. This option has no effect when
--parallel is used.
The request rate is provided as "N/U" where N is an integer num?
ber and U is a time unit. Supported units are 's' (second), 'm'
(minute), 'h' (hour) and 'd' /(day, as in a 24 hour unit). The
default time unit, if no "/U" is provided, is number of transfers
per hour.
If curl is told to allow 10 requests per minute, it does not
start the next request until 6 seconds have elapsed since the
previous transfer was started.
This function uses millisecond resolution. If the allowed fre?
quency is set more than 1000 per second, it instead runs unre?
stricted.
When retrying transfers, enabled with --retry, the separate retry
delay logic is used and not this setting.
Starting in version 8.10.0, you can specify the number of time
units in the rate expression. Make curl do no more than 5 trans?
fers per 15 seconds with "5/15s" or limit it to 3 transfers per 4
hours with "3/4h". No spaces allowed.
This option is global and does not need to be specified for each
use of --next.
If --rate is provided several times, the last set value is used.
Examples:
curl --rate 2/s https://example.com ...
curl --rate 3/h https://example.com ...
curl --rate 14/m https://example.com ...
Added in 7.84.0. See also --limit-rate and --retry-delay.
--raw (HTTP) When used, it disables all internal HTTP decoding of con?
tent or transfer encodings and instead makes them passed on unal?
tered, raw.
Providing --raw multiple times has no extra effect. Disable it
again with --no-raw.
Example:
curl --raw https://example.com
See also --tr-encoding.
-e, --referer
(HTTP) Set the referrer URL in the HTTP request. This can also be
set with the --header flag of course. When used with --location
you can append ";auto"" to the --referer URL to make curl auto?
matically set the previous URL when it follows a Location:
header. The ";auto" string can be used alone, even if you do not
set an initial --referer.
If --referer is provided several times, the last set value is
used.
Examples:
curl --referer "https://fake.example" https://example.com
curl --referer "https://fake.example;auto" -L https://example.com
curl --referer ";auto" -L https://example.com
See also --user-agent and --header.
-J, --remote-header-name
(HTTP) Tell the --remote-name option to use the server-specified
Content-Disposition filename instead of extracting a filename
from the URL. If the server-provided filename contains a path,
that is stripped off before the filename is used.
The file is saved in the current directory, or in the directory
specified with --output-dir.
If the server specifies a filename and a file with that name al?
ready exists in the destination directory, it is not overwritten
and an error occurs - unless you allow it by using the --clobber
option. If the server does not specify a filename then this op?
tion has no effect.
There is no attempt to decode %-sequences (yet) in the provided
filename, so this option may provide you with rather unexpected
filenames.
This feature uses the name from the "filename" field, it does not
yet support the "filename*" field (filenames with explicit char?
acter sets).
WARNING: Exercise judicious use of this option, especially on
Windows. A rogue server could send you the name of a DLL or other
file that could be loaded automatically by Windows or some third
party software.
Providing --remote-header-name multiple times has no extra ef?
fect. Disable it again with --no-remote-header-name.
Example:
curl -OJ https://example.com/file
See also --remote-name.
-O, --remote-name
Write output to a local file named like the remote file we get.
(Only the file part of the remote file is used, the path is cut
off.)
The file is saved in the current working directory. If you want
the file saved in a different directory, make sure you change the
current working directory before invoking curl with this option
or use --output-dir.
The remote filename to use for saving is extracted from the given
URL, nothing else, and if it already exists it is overwritten. If
you want the server to be able to choose the filename refer to
--remote-header-name which can be used in addition to this op?
tion. If the server chooses a filename and that name already ex?
ists it is not overwritten.
There is no URL decoding done on the filename. If it has %20 or
other URL encoded parts of the name, they end up as-is as file?
name.
You may use this option as many times as the number of URLs you
have.
Before curl 8.10.0, curl returned an error if the URL ended with
a slash, which means that there is no filename part in the URL.
Starting in 8.10.0, curl sets the filename to the last directory
part of the URL or if that also is missing to "curl_response"
(without extension) for this situation.
--remote-name is associated with a single URL. Use it once per
URL when you use several URLs in a command line.
Examples:
curl -O https://example.com/filename
curl -O https://example.com/filename -O https://example.com/file2
See also --remote-name-all, --output-dir and --re?
mote-header-name.
--remote-name-all
Change the default action for all given URLs to be dealt with as
if --remote-name were used for each one. If you want to disable
that for a specific URL after --remote-name-all has been used,
you must use "-o -" or --no-remote-name.
Providing --remote-name-all multiple times has no extra effect.
Disable it again with --no-remote-name-all.
Example:
curl --remote-name-all ftp://example.com/file1 ftp://example.com/file2
See also --remote-name.
-R, --remote-time
Make curl attempt to figure out the timestamp of the remote file
that is getting downloaded, and if that is available make the lo?
cal file get that same timestamp.
Providing --remote-time multiple times has no extra effect. Dis?
able it again with --no-remote-time.
Example:
curl --remote-time -o foo https://example.com
See also --remote-name and --time-cond.
--remove-on-error
Remove the output file if an error occurs. If curl returns an er?
ror when told to save output in a local file. This prevents curl
from leaving a partial file in the case of an error during trans?
fer.
If the output is not a regular file, this option has no effect.
The --continue-at option cannot be used together with --re?
move-on-error.
Providing --remove-on-error multiple times has no extra effect.
Disable it again with --no-remove-on-error.
Example:
curl --remove-on-error -o output https://example.com
Added in 7.83.0. See also --fail.
-X, --request
Change the method to use when starting the transfer.
curl passes on the verbatim string you give it in the request
without any filter or other safe guards. That includes white
space and control characters.
HTTP Specifies a custom request method to use when communicat?
ing with the HTTP server. The specified request method is
used instead of the method otherwise used (which defaults
to GET). Read the HTTP 1.1 specification for details and
explanations. Common additional HTTP requests include PUT
and DELETE, while related technologies like WebDAV offers
PROPFIND, COPY, MOVE and more.
Normally you do not need this option. All sorts of GET,
HEAD, POST and PUT requests are rather invoked by using
dedicated command line options.
This option only changes the actual word used in the HTTP
request, it does not alter the way curl behaves. For exam?
ple if you want to make a proper HEAD request, using -X
HEAD does not suffice. You need to use the --head option.
If --location is used, the method string you set with
--request is used for all requests, which may cause unin?
tended side-effects when curl does not change request
method according to the HTTP 30x response codes - and sim?
ilar. Consider using --follow instead in combination with
--request.
FTP Specifies a custom FTP command to use instead of LIST when
doing file lists with FTP.
POP3 Specifies a custom POP3 command to use instead of LIST or
RETR.
IMAP Specifies a custom IMAP command to use instead of LIST.
SMTP Specifies a custom SMTP command to use instead of HELP or
VRFY.
If --request is provided several times, the last set value is
used.
Examples:
curl --request "DELETE" https://example.com
curl -X NLST ftp://example.com/
See also --request-target and --follow.
--request-target
(HTTP) Use an alternative target (path) instead of using the path
as provided in the URL. Particularly useful when wanting to issue
HTTP requests without leading slash or other data that does not
follow the regular URL pattern, like "OPTIONS *".
curl passes on the verbatim string you give it in the request
without any filter or other safe guards. That includes white
space and control characters.
If --request-target is provided several times, the last set value
is used.
Example:
curl --request-target "*" -X OPTIONS https://example.com
See also --request.
--resolve <[+]host:port:addr[,addr]...>
Provide a custom address for a specific host and port pair. Using
this, you can make the curl requests(s) use a specified address
and prevent the otherwise normally resolved address to be used.
Consider it a sort of /etc/hosts alternative provided on the com?
mand line. The port number should be the number used for the spe?
cific protocol the host is used for. It means you need several
entries if you want to provide addresses for the same host but
different ports.
By specifying "*" as host you can tell curl to resolve any host
and specific port pair to the specified address. Wildcard is re?
solved last so any --resolve with a specific host and port is
used first.
The provided address set by this option is used even if --ipv4 or
--ipv6 is set to make curl use another IP version.
By prefixing the host with a '+' you can make the entry time out
after curl's default timeout (1 minute). Note that this only
makes sense for long running parallel transfers with a lot of
files. In such cases, if this option is used curl tries to re?
solve the host as it normally would once the timeout has expired.
Provide IPv6 addresses within [brackets].
To redirect connects from a specific hostname or any hostname,
independently of port number, consider the --connect-to option.
Support for resolving with wildcard was added in 7.64.0.
Support for the '+' prefix was added in 7.75.0.
Support for specifying the host component as an IPv6 address was
added in 8.13.0.
--resolve can be used several times in a command line
Examples:
curl --resolve example.com:443:127.0.0.1 https://example.com
curl --resolve example.com:443:[2001:db8::252f:efd6] https://example.com
See also --connect-to and --alt-svc.
--retry
If a transient error is returned when curl tries to perform a
transfer, it retries this number of times before giving up. Set?
ting the number to 0 makes curl do no retries (which is the de?
fault). Transient error means either: a timeout, an FTP 4xx re?
sponse code or an HTTP 408, 429, 500, 502, 503, 504, 522 or 524
response code.
When curl is about to retry a transfer, it first waits one second
and then for all forthcoming retries it doubles the waiting time
until it reaches 10 minutes, which then remains the set fixed de?
lay time between the rest of the retries. By using --retry-delay
you disable this exponential backoff algorithm. See also
--retry-max-time to limit the total time allowed for retries.
curl complies with the Retry-After: response header if one was
present to know when to issue the next retry (added in 7.66.0).
If --retry is provided several times, the last set value is used.
Example:
curl --retry 7 https://example.com
See also --retry-max-time, --retry-connrefused and --retry-delay.
--retry-all-errors
Retry on any error. This option is used together with --retry.
This option is the "sledgehammer" of retrying. Do not use this
option by default (for example in your curlrc), there may be un?
intended consequences such as sending or receiving duplicate
data. Do not use with redirected input or output. You might be
better off handling your unique problems in a shell script.
Please read the example below.
WARNING: For server compatibility curl attempts to retry failed
flaky transfers as close as possible to how they were started,
but this is not possible with redirected input or output. For ex?
ample, before retrying it removes output data from a failed par?
tial transfer that was written to an output file. However this is
not true of data redirected to a | pipe or > file, which are not
reset. We strongly suggest you do not parse or record output via
redirect in combination with this option, since you may receive
duplicate data.
By default curl does not return an error for transfers with an
HTTP response code that indicates an HTTP error, if the transfer
was successful. For example, if a server replies 404 Not Found
and the reply is fully received then that is not an error. When
--retry is used then curl retries on some HTTP response codes
that indicate transient HTTP errors, but that does not include
most 4xx response codes such as 404. If you want to retry on all
response codes that indicate HTTP errors (4xx and 5xx) then com?
bine with --fail.
Providing --retry-all-errors multiple times has no extra effect.
Disable it again with --no-retry-all-errors.
Example:
curl --retry 5 --retry-all-errors https://example.com
Added in 7.71.0. See also --retry.
--retry-connrefused
In addition to the other conditions, also consider ECONNREFUSED
as a transient error for --retry. This option is used together
with --retry. Normally, a confused connection is not considered a
transient error and therefore thus not otherwise trigger a retry.
Providing --retry-connrefused multiple times has no extra effect.
Disable it again with --no-retry-connrefused.
Example:
curl --retry-connrefused --retry 7 https://example.com
See also --retry and --retry-all-errors.
--retry-delay
Make curl sleep this amount of time before each retry when a
transfer has failed with a transient error (it changes the de?
fault backoff time algorithm between retries). This option is
only interesting if --retry is also used. Setting this delay to
zero makes curl use the default backoff time.
By default, curl uses an exponentially increasing timeout between
retries.
Starting in curl 8.16.0, this option accepts a time as decimal
number for parts of seconds. The decimal value needs to be pro?
vided using a dot (.) as decimal separator - not the local ver?
sion even if it might be using another separator.
If --retry-delay is provided several times, the last set value is
used.
Example:
curl --retry-delay 5 --retry 7 https://example.com
See also --retry and --retry-max-time.
--retry-max-time
The retry timer is reset before the first transfer attempt. Re?
tries are done as usual (see --retry) as long as the timer has
not reached this given limit. Notice that if the timer has not
reached the limit, the request is made and while performing, it
may take longer than this given time period. To limit a single
request's maximum time, use --max-time. Set this option to zero
to not timeout retries.
Starting in curl 8.16.0, this option accepts a time as decimal
number for parts of seconds. The decimal value needs to be pro?
vided using a dot (.) as decimal separator - not the local ver?
sion even if it might be using another separator.
If --retry-max-time is provided several times, the last set value
is used.
Example:
curl --retry-max-time 30 --retry 10 https://example.com
See also --retry and --retry-delay.
--sasl-authzid
(LDAP IMAP POP3 SMTP) Use this authorization identity (authzid),
during SASL PLAIN authentication, in addition to the authentica?
tion identity (authcid) as specified by --user.
If the option is not specified, the server derives the authzid
from the authcid, but if specified, and depending on the server
implementation, it may be used to access another user's inbox,
that the user has been granted access to, or a shared mailbox for
example.
If --sasl-authzid is provided several times, the last set value
is used.
Example:
curl --sasl-authzid zid imap://example.com/
Added in 7.66.0. See also --login-options.
--sasl-ir
(LDAP IMAP POP3 SMTP) Enable initial response in SASL authentica?
tion. Such an "initial response" is a message sent by the client
to the server after the client selects an authentication mecha?
nism.
Providing --sasl-ir multiple times has no extra effect. Disable
it again with --no-sasl-ir.
Example:
curl --sasl-ir imap://example.com/
See also --sasl-authzid.
--service-name
Set the service name for SPNEGO.
If --service-name is provided several times, the last set value
is used.
Example:
curl --service-name sockd/server https://example.com
See also --negotiate and --proxy-service-name.
-S, --show-error
When used with --silent, it makes curl show an error message if
it fails.
This option is global and does not need to be specified for each
use of --next.
Providing --show-error multiple times has no extra effect. Dis?
able it again with --no-show-error.
Example:
curl --show-error --silent https://example.com
See also --no-progress-meter.
-i, --show-headers
(HTTP FTP) Show response headers in the output. HTTP response
headers can include things like server name, cookies, date of the
document, HTTP version and more. With non-HTTP protocols, the
"headers" are other server communication.
This option makes the response headers get saved in the same
stream/output as the data. --dump-header exists to save headers
in a separate stream.
To view the request headers, consider the --verbose option.
Prior to 7.75.0 curl did not print the headers if --fail was used
in combination with this option and there was an error reported
by the server.
This option was called --include before 8.10.0. The previous name
remains functional.
Providing --show-headers multiple times has no extra effect.
Disable it again with --no-show-headers.
Example:
curl -i https://example.com
See also --verbose and --dump-header.
--sigalgs
(TLS) Set specific signature algorithms to use during SSL session
establishment according to RFC 5246, 7.4.1.4.1.
An algorithm can use either a signature algorithm and a hash al?
gorithm pair separated by a "+" (e.g. "ECDSA+SHA224"), or its TLS
1.3 signature scheme name (e.g. "ed25519").
Multiple algorithms can be provided by separating them with ":"
(e.g. "DSA+SHA256:rsa_pss_pss_sha256"). The parameter is avail?
able as "-sigalgs" in the OpenSSL "s_client" and "s_server" util?
ities.
"--sigalgs" allows a OpenSSL powered curl to make SSL-connections
with exactly the signature algorithms requested by the client,
avoiding nontransparent client/server negotiations.
If this option is set, the default signature algorithm list built
into OpenSSL are ignored.
If --sigalgs is provided several times, the last set value is
used.
Example:
curl --sigalgs ecdsa_secp256r1_sha256 https://example.com
Added in 8.14.0. See also --ciphers.
-s, --silent
Silent or quiet mode. Do not show progress meter or error mes?
sages. Makes curl mute. It still outputs the data you ask for,
potentially even to the terminal/stdout unless you redirect it.
Use --show-error in addition to this option to disable progress
meter but still show error messages.
Providing --silent multiple times has no extra effect. Disable
it again with --no-silent.
Example:
curl -s https://example.com
See also --verbose, --stderr and --no-progress-meter.
--skip-existing
If there is a local file present when a download is requested,
the operation is skipped. Note that curl cannot know if the local
file was previously downloaded fine, or if it is incomplete etc,
it just knows if there is a filename present in the file system
or not and it skips the transfer if it is.
Providing --skip-existing multiple times has no extra effect.
Disable it again with --no-skip-existing.
Example:
curl --skip-existing --output local/dir/file https://example.com
Added in 8.10.0. See also --output, --remote-name and --no-clob?
ber.
--socks4
Use the specified SOCKS4 proxy. If the port number is not speci?
fied, it is assumed at port 1080. Using this socket type makes
curl resolve the hostname and pass the address on to the proxy.
To specify the proxy on a Unix domain socket, use localhost for
host and append the absolute path to the domain socket. For exam?
ple: "socks4://localhost/path/to/socket.sock" (the scheme may be
omitted).
This option overrides any previous use of --proxy, as they are
mutually exclusive.
This option is superfluous since you can specify a socks4 proxy
with --proxy using a socks4:// protocol prefix.
--preproxy can be used to specify a SOCKS proxy at the same time
proxy is used with an HTTP/HTTPS proxy. In such a case, curl
first connects to the SOCKS proxy and then connects (through
SOCKS) to the HTTP or HTTPS proxy.
If --socks4 is provided several times, the last set value is
used.
Example:
curl --socks4 hostname:4096 https://example.com
This option is mutually exclusive with --proxy, --socks4a,
--socks5 and --socks5-hostname. See also --socks4a, --socks5 and
--socks5-hostname.
--socks4a
Use the specified SOCKS4a proxy. If the port number is not speci?
fied, it is assumed at port 1080. This asks the proxy to resolve
the hostname.
To specify the proxy on a Unix domain socket, use localhost for
host and append the absolute path to the domain socket. For exam?
ple: "socks4a://localhost/path/to/socket.sock" (the scheme may be
omitted).
This option overrides any previous use of --proxy, as they are
mutually exclusive.
This option is superfluous since you can specify a socks4a proxy
with --proxy using a socks4a:// protocol prefix.
--preproxy can be used to specify a SOCKS proxy at the same time
--proxy is used with an HTTP/HTTPS proxy. In such a case, curl
first connects to the SOCKS proxy and then connects (through
SOCKS) to the HTTP or HTTPS proxy.
If --socks4a is provided several times, the last set value is
used.
Example:
curl --socks4a hostname:4096 https://example.com
This option is mutually exclusive with --proxy, --socks4,
--socks5 and --socks5-hostname. See also --socks4, --socks5 and
--socks5-hostname.
--socks5
Use the specified SOCKS5 proxy - but resolve the hostname lo?
cally. If the port number is not specified, it is assumed at port
1080.
To specify the proxy on a Unix domain socket, use localhost for
host and append the absolute path to the domain socket. For exam?
ple: "socks5://localhost/path/to/socket.sock" (the scheme may be
omitted).
This option overrides any previous use of --proxy, as they are
mutually exclusive.
This option is superfluous since you can specify a socks5 proxy
with --proxy using a socks5:// protocol prefix.
--preproxy can be used to specify a SOCKS proxy at the same time
--proxy is used with an HTTP/HTTPS proxy. In such a case, curl
first connects to the SOCKS proxy and then connects (through
SOCKS) to the HTTP or HTTPS proxy.
This option does not work with FTPS or LDAP.
If --socks5 is provided several times, the last set value is
used.
Examples:
curl --socks5 proxy.example:7000 https://example.com
curl --socks5 localhost/path/unix-domain https://example.com
This option is mutually exclusive with --proxy, --socks4,
--socks4a and --socks5-hostname. See also --socks5-hostname and
--socks4a.
--socks5-basic
Use username/password authentication when connecting to a SOCKS5
proxy. The username/password authentication is enabled by de?
fault. Use --socks5-gssapi to force GSS-API authentication to
SOCKS5 proxies.
Providing --socks5-basic multiple times has no extra effect.
Example:
curl --socks5-basic --socks5 hostname:4096 https://example.com
See also --socks5.
--socks5-gssapi
(GSS/kerberos) Use GSS-API authentication when connecting to a
SOCKS5 proxy. The GSS-API authentication is enabled by default
(if curl is compiled with GSS-API support). Use --socks5-basic to
force username/password authentication to SOCKS5 proxies.
Providing --socks5-gssapi multiple times has no extra effect.
Disable it again with --no-socks5-gssapi.
Example:
curl --socks5-gssapi --socks5 hostname:4096 https://example.com
See also --socks5.
--socks5-gssapi-nec
(GSS/kerberos) As part of the GSS-API negotiation a protection
mode is negotiated. RFC 1961 says in section 4.3/4.4 it should be
protected, but the NEC reference implementation does not. The op?
tion --socks5-gssapi-nec allows the unprotected exchange of the
protection mode negotiation.
Providing --socks5-gssapi-nec multiple times has no extra effect.
Disable it again with --no-socks5-gssapi-nec.
Example:
curl --socks5-gssapi-nec --socks5 hostname:4096 https://example.com
See also --socks5.
--socks5-gssapi-service
Set the service name for a socks server. Default is
rcmd/server-fqdn.
If --socks5-gssapi-service is provided several times, the last
set value is used.
Example:
curl --socks5-gssapi-service sockd --socks5 hostname:4096 https://example.com
See also --socks5.
--socks5-hostname
Use the specified SOCKS5 proxy (and let the proxy resolve the
hostname). If the port number is not specified, it is assumed at
port 1080.
To specify the proxy on a Unix domain socket, use localhost for
host and append the absolute path to the domain socket. For exam?
ple: "socks5h://localhost/path/to/socket.sock" (the scheme may be
omitted).
This option overrides any previous use of --proxy, as they are
mutually exclusive.
This option is superfluous since you can specify a socks5 host?
name proxy with --proxy using a socks5h:// protocol prefix.
--preproxy can be used to specify a SOCKS proxy at the same time
--proxy is used with an HTTP/HTTPS proxy. In such a case, curl
first connects to the SOCKS proxy and then connects (through
SOCKS) to the HTTP or HTTPS proxy.
If --socks5-hostname is provided several times, the last set
value is used.
Example:
curl --socks5-hostname proxy.example:7000 https://example.com
This option is mutually exclusive with --proxy, --socks4,
--socks4a and --socks5. See also --socks5 and --socks4a.
-Y, --speed-limit
If a transfer is slower than this set speed (in bytes per second)
for a given number of seconds, it gets aborted. The time period
is set with --speed-time and is 30 seconds by default.
If --speed-limit is provided several times, the last set value is
used.
Example:
curl --speed-limit 300 --speed-time 10 https://example.com
See also --speed-time, --limit-rate and --max-time.
-y, --speed-time
If a transfer runs slower than speed-limit bytes per second dur?
ing a speed-time period, the transfer is aborted. If speed-time
is used, the default speed-limit is 1 unless set with
--speed-limit.
This option controls transfers (in both directions) but does not
affect slow connects etc. If this is a concern for you, try the
--connect-timeout option.
If --speed-time is provided several times, the last set value is
used.
Example:
curl --speed-limit 300 --speed-time 10 https://example.com
See also --speed-limit and --limit-rate.
--ssl (FTP IMAP POP3 SMTP LDAP) Warning: this is considered an insecure
option. Consider using --ssl-reqd instead to be sure curl up?
grades to a secure connection.
Try to use SSL/TLS for the connection - often referred to as
STARTTLS or STLS because of the involved commands. Reverts to a
non-secure connection if the server does not support SSL/TLS. See
also --ftp-ssl-control and --ssl-reqd for different levels of en?
cryption required.
This option is handled in LDAP (added in 7.81.0). It is fully
supported by the OpenLDAP backend and ignored by the generic ldap
backend.
Please note that a server may close the connection if the negoti?
ation fails.
This option was formerly known as --ftp-ssl. That option name can
still be used but might be removed in a future version.
Providing --ssl multiple times has no extra effect. Disable it
again with --no-ssl.
Example:
curl --ssl pop3://example.com/
See also --ssl-reqd, --insecure and --ciphers.
--ssl-allow-beast
(TLS) Do not work around a security flaw in the TLS1.0 protocol
known as BEAST. If this option is not used, the TLS layer may use
workarounds known to cause interoperability problems with some
older server implementations.
This option only changes how curl does TLS 1.0 and has no effect
on later TLS versions.
WARNING: this option loosens the TLS security, and by using this
flag you ask for exactly that.
Providing --ssl-allow-beast multiple times has no extra effect.
Disable it again with --no-ssl-allow-beast.
Example:
curl --ssl-allow-beast https://example.com
See also --proxy-ssl-allow-beast and --insecure.
--ssl-auto-client-cert
(TLS) (Schannel) Automatically locate and use a client certifi?
cate for authentication, when requested by the server. Since the
server can request any certificate that supports client authenti?
cation in the OS certificate store it could be a privacy viola?
tion and unexpected.
Providing --ssl-auto-client-cert multiple times has no extra ef?
fect. Disable it again with --no-ssl-auto-client-cert.
Example:
curl --ssl-auto-client-cert https://example.com
Added in 7.77.0. See also --proxy-ssl-auto-client-cert.
--ssl-no-revoke
(TLS) (Schannel) Disable certificate revocation checks. WARNING:
this option loosens the SSL security, and by using this flag you
ask for exactly that.
Providing --ssl-no-revoke multiple times has no extra effect.
Disable it again with --no-ssl-no-revoke.
Example:
curl --ssl-no-revoke https://example.com
See also --crlfile.
--ssl-reqd
(FTP IMAP POP3 SMTP LDAP) Require SSL/TLS for the connection -
often referred to as STARTTLS or STLS because of the involved
commands. Terminates the connection if the transfer cannot be up?
graded to use SSL/TLS.
This option is handled in LDAP (added in 7.81.0). It is fully
supported by the OpenLDAP backend and rejected by the generic
ldap backend if explicit TLS is required.
This option is unnecessary if you use a URL scheme that in itself
implies immediate and implicit use of TLS, like for FTPS, IMAPS,
POP3S, SMTPS and LDAPS. Such a transfer always fails if the TLS
handshake does not work.
This option was formerly known as --ftp-ssl-reqd.
Providing --ssl-reqd multiple times has no extra effect. Disable
it again with --no-ssl-reqd.
Example:
curl --ssl-reqd ftp://example.com
See also --ssl and --insecure.
--ssl-revoke-best-effort
(TLS) (Schannel) Ignore certificate revocation checks when they
failed due to missing/offline distribution points for the revoca?
tion check lists.
Providing --ssl-revoke-best-effort multiple times has no extra
effect. Disable it again with --no-ssl-revoke-best-effort.
Example:
curl --ssl-revoke-best-effort https://example.com
Added in 7.70.0. See also --crlfile and --insecure.
--ssl-sessions
(TLS) **WARNING**: this option is experimental. Do not use in
production.
Use the given file to load SSL session tickets into curl's cache
before starting any transfers. At the end of a successful curl
run, the cached SSL sessions tickets are saved to the file, re?
placing any previous content.
The file does not have to exist, but curl reports an error if it
is unable to create it. Unused loaded tickets are saved again,
unless they get replaced or purged from the cache for space rea?
sons.
Using a session file allows "--tls-earlydata" to send the first
request in "0-RTT" mode, should an SSL session with the feature
be found. Note that a server may not support early data. Also
note that early data does not provide forward secrecy, e.g. is
not as secure.
The SSL session tickets are stored as base64 encoded text, each
ticket on its own line. The hostnames are cryptographically
salted and hashed. While this prevents someone from easily seeing
the hosts you contacted, they could still check if a specific
hostname matches one of the values.
This feature requires that the underlying libcurl was built with
the experimental SSL session import/export feature (SSLS-EXPORT)
enabled.
If --ssl-sessions is provided several times, the last set value
is used.
Example:
curl --ssl-sessions sessions.txt https://example.com
Added in 8.12.0. See also --tls-earlydata.
-2, --sslv2
(SSL) This option previously asked curl to use SSLv2, but is now
ignored (added in 7.77.0). SSLv2 is widely considered insecure
(see RFC 6176).
Providing --sslv2 multiple times has no extra effect.
Example:
curl --sslv2 https://example.com
For --sslv2 to work, it requires that the underlying libcurl is
built to support TLS. This option is mutually exclusive with
--sslv3, --tlsv1, --tlsv1.1 and --tlsv1.2. See also --http1.1
and --http2.
-3, --sslv3
(SSL) This option previously asked curl to use SSLv3, but is now
ignored (added in 7.77.0). SSLv3 is widely considered insecure
(see RFC 7568).
Providing --sslv3 multiple times has no extra effect.
Example:
curl --sslv3 https://example.com
For --sslv3 to work, it requires that the underlying libcurl is
built to support TLS. This option is mutually exclusive with
--sslv2, --tlsv1, --tlsv1.1 and --tlsv1.2. See also --http1.1
and --http2.
--stderr
Redirect all writes to stderr to the specified file instead. If
the filename is a plain '-', it is instead written to stdout.
This option is global and does not need to be specified for each
use of --next.
If --stderr is provided several times, the last set value is
used.
Example:
curl --stderr output.txt https://example.com
See also --verbose and --silent.
--styled-output
Enable automatic use of bold font styles when writing HTTP head?
ers to the terminal. Use --no-styled-output to switch them off.
Styled output requires a terminal that supports bold fonts. This
feature is not present on curl for Windows due to lack of this
capability.
This option is global and does not need to be specified for each
use of --next.
Providing --styled-output multiple times has no extra effect.
Disable it again with --no-styled-output.
Example:
curl --styled-output -I https://example.com
See also --head and --verbose.
--suppress-connect-headers
When --proxytunnel is used and a CONNECT request is made, do not
output proxy CONNECT response headers. This option is meant to be
used with --dump-header or --show-headers which are used to show
protocol headers in the output. It has no effect on debug options
such as --verbose or --trace, or any statistics.
Providing --suppress-connect-headers multiple times has no extra
effect. Disable it again with --no-suppress-connect-headers.
Example:
curl --suppress-connect-headers --show-headers -x proxy https://example.com
See also --dump-header, --show-headers and --proxytunnel.
--tcp-fastopen
Enable use of TCP Fast Open (RFC 7413). TCP Fast Open is a TCP
extension that allows data to be sent earlier over the connection
(before the final handshake ACK) if the client and server have
been connected previously.
Providing --tcp-fastopen multiple times has no extra effect.
Disable it again with --no-tcp-fastopen.
Example:
curl --tcp-fastopen https://example.com
See also --false-start.
--tcp-nodelay
Turn on the TCP_NODELAY option.
This option disables the Nagle algorithm on TCP connections. The
purpose of this algorithm is to minimize the number of small
packets on the network (where "small packets" means TCP segments
less than the Maximum Segment Size for the network).
Maximizing the amount of data sent per TCP segment is good be?
cause it amortizes the overhead of the send. However, in some
cases small segments may need to be sent without delay. This is
less efficient than sending larger amounts of data at a time, and
can contribute to congestion on the network if overdone.
curl sets this option by default and you need to explicitly
switch it off if you do not want it on.
Providing --tcp-nodelay multiple times has no extra effect. Dis?
able it again with --no-tcp-nodelay.
Example:
curl --tcp-nodelay https://example.com
See also --no-buffer.
-t, --telnet-option
(TELNET) Pass options to the telnet protocol. Supported options
are:
TTYPE=
Sets the terminal type.
XDISPLOC=
Sets the X display location.
NEW_ENV=
Sets an environment variable.
--telnet-option can be used several times in a command line
Example:
curl -t TTYPE=vt100 telnet://example.com/
See also --config.
--tftp-blksize
(TFTP) Set the TFTP BLKSIZE option (must be 512 or larger). This
is the block size that curl tries to use when transferring data
to or from a TFTP server. By default 512 bytes are used.
If --tftp-blksize is provided several times, the last set value
is used.
Example:
curl --tftp-blksize 1024 tftp://example.com/file
See also --tftp-no-options.
--tftp-no-options
(TFTP) Do not send TFTP options requests. This improves interop
with some legacy servers that do not acknowledge or properly im?
plement TFTP options. When this option is used --tftp-blksize is
ignored.
Providing --tftp-no-options multiple times has no extra effect.
Disable it again with --no-tftp-no-options.
Example:
curl --tftp-no-options tftp://192.168.0.1/
See also --tftp-blksize.
-z, --time-cond