If you’ve spent any time testing APIs at work, you’ve probably fallen into the same rhythm: log in, copy the token, paste it into the next request, watch it expire, repeat. The GUI tools built to solve this are fine enough until you try to work with a team. Sharing configs is awkward. Version control feels like an afterthought. And in a corporate environment, there’s usually a licensing conversation somewhere in the mix that has absolutely nothing to do with the API you’re actually trying to test.
I got tired of it, so I built curl-auth-api .
The premise is simple. curl already has everything you need, including a -K flag that lets you run requests from plain text config files instead of typing them out on the command line each time. The only genuinely tedious part is updating the bearer token when it expires. My script handles that one step: it logs in, pulls the token from the response, writes it into your request config, and runs the call. That’s the whole thing.
Dependencies are bash, curl, and jq. Chances are all three are already on your machine.
The real upside is version control
Automating the token refresh is the headline feature, but the bigger practical win is what you’re left with: a directory of plain text files, one per request, that behave like any other source code. You can commit them, diff them, review them in a pull request. Onboarding a teammate means pointing them at the repo, not walking them through an export/import flow in some proprietary format.
In corporate environments especially, this matters more than it might seem. When your testing setup is tied to a specific GUI client, you inherit its collaboration model, which is usually not great. With plain curl config files, your API requests live right next to your code, move with it, and require nothing beyond what’s already sitting on any developer’s machine. No sync account, no licensing tier, no format that only one tool can read.
What a run actually looks like
The script handles auth and execution in separate steps, prints the response pretty-printed if it’s JSON, and finishes with a short metrics block:
========== Request Metrics ==========
--- Metadata ---
HTTP Code: 200
Time Total: 0.863101s
Download Size: 1382 bytes
Effective URL: https://dummyjson.com/auth/me
HTTP status, total request time, download size, effective URL: it’s enough to catch a slow endpoint or confirm you’re pointing at the right place, without setting up a monitoring dashboard.
Who it’s aimed at
Anyone who tests authenticated APIs and doesn’t want their workflow living inside a GUI client with a sync account and a pricing page. It also plays nicely in CI. If either the login or the target request returns a non-2xx, the script exits non-zero, so you can drop it straight into a pipeline without any extra glue.
If that’s something you’d find useful, the repository is on GitHub . The README covers the config file format, how to structure a new request, and how to adapt it to your own auth setup.
Here’s the git clone URL if you want to try it straightaway:
git clone https://github.com/gsarkardev/curl-auth-api.git
I’ll be improving the tool in the coming days with more features people are likely to use. Suggestions and feedback are welcome.