cURL to Salesforce Apex HttpRequest Converter — Offline & Secure

How cURL maps to Apex HttpRequest

The generated code follows the canonical Salesforce callout shape: HttpRequest req = new HttpRequest(); followed by req.setEndpoint(...) with your URL, req.setMethod(...) with the verb uppercased, and one req.setHeader(name, value) call per -H flag, in the same order curl sends them. Execution uses the standard Http http = new Http(); HttpResponse res = http.send(req); pair, with System.debug lines printing the status code and response body.

The output is valid anonymous Apex: copy it into the Developer Console (Debug → Open Execute Anonymous Window) and run it as-is, or lift the request-building block into a class method. Bare GET requests simply omit setBody and setHeader when your command carried no headers or data.

Single-quote escaping and Apex string-literal limits

Apex string literals are delimited by single quotes, which is exactly where naive converters break. This tool escapes every single quote as \' and doubles every backslash to \\ across the URL, header values, and body, so pasted JSON with apostrophes, Windows paths, or regex fragments compiles cleanly. Newlines inside raw bodies are emitted as \n escapes, keeping every literal on a single source line.

JSON bodies are re-serialized in minified form onto that single line — no multi-line literals that break mid-string when pasted into the Developer Console, and no pretty-print padding that inflates the payload toward Apex's compiled string-literal length limits. The bytes you send are exactly the bytes curl would send.

Basic auth through EncodingUtil

When your command carries -u user:pass — or credentials embedded in the URL — the converter emits req.setHeader('Authorization', 'Basic ' + EncodingUtil.base64Encode(Blob.valueOf('user:pass')));, the idiomatic Apex pattern. The base64 encoding happens at runtime inside your org, computed by Salesforce with correct UTF-8 semantics instead of being baked into the snippet as an opaque precomputed string.

An explicit Authorization header from your cURL command always wins: bearer tokens and API keys pass through untouched, and the generated Basic header is suppressed so the request never carries two conflicting credentials.

Running the generated callout in Salesforce

Apex callouts can only reach endpoints you have whitelisted: add the host under Setup → Remote Site Settings, or configure a Named Credential and swap the endpoint for callout:My_Credential/path. Wrap http.send(req) in a try/catch for System.CalloutException so DNS failures, timeouts, and unexpected redirects surface the way production code expects.

Keep Salesforce governor limits in mind when adapting the snippet: Apex allows 100 callouts per transaction, req.setTimeout() accepts up to 120,000 milliseconds, and a callout cannot follow uncommitted DML in the same transaction. It is a stricter environment than curl, but the generated request itself transfers unchanged.

Is this cURL to Apex converter really free and private?

Yes. The page ships as static HTML and JavaScript, and the transpiler runs entirely in your browser — commands containing org credentials, session IDs, or API tokens are never uploaded, stored, or logged.

Where can I run the generated Apex code?

Anywhere Apex runs. The snippet is valid anonymous Apex — paste it into the Developer Console's Execute Anonymous Window — or move the request-building lines into an Apex class or test method unchanged.

How is basic auth (-u) converted for Apex?

The converter emits an Authorization header built with EncodingUtil.base64Encode(Blob.valueOf('user:pass')), so the base64 encoding runs at runtime inside Salesforce with correct UTF-8 handling — the same pattern the Apex documentation uses.

How does the converter escape quotes for Apex strings?

Apex uses single-quoted strings, so every single quote in your URL, headers, or body is escaped to \' and every backslash is doubled. Newlines become \n escapes so each literal stays on one source line.

Why is my JSON body minified to a single line?

Multi-line string literals are fragile to paste into the Developer Console, and padded bodies push against Apex's compiled string-literal length limits. Minifying keeps the payload byte-identical to what curl sends while staying safe to copy.

Why does the generated callout fail with an 'unauthorized endpoint' error?

Salesforce blocks callouts to hosts that are not whitelisted. Add the endpoint under Setup → Remote Site Settings, or configure a Named Credential and reference it as callout:My_Credential in setEndpoint — the rest of the generated code works unchanged.