Toolpaper

cURL with API key in Go

Paste a curl command that uses API key and get Go code using net/http. Toolpaper also detects secrets and offers a one-click redaction before sharing.

Quick answer

To convert a cURL command to Go, paste it into the Toolpaper workbench below. It parses the command in your browser and emits idiomatic Go code — headers, query string, request body, authentication (Bearer, Basic, API key), and cookies are all wired up automatically. No data is uploaded; conversion is fully client-side.

Prefer a different target? See the full cURL to Go reference, or jump to the same guide in JavaScript, Node.js, or Python.

InputcURL command
1 secret
MethodGET·Headers1·Body—· Chars 60
OutputGo · net/http(stdlib)
package main

import (
    "fmt"
    "io"
    "net/http"
)

func main() {
    client := &http.Client{CheckRedirect: func(req *http.Request, via []*http.Request) error { return http.ErrUseLastResponse }}
    req, _ := http.NewRequest("GET", "https://api.example.com/me", nil)
    req.Header.Set("X-API-Key", "YOUR_KEY")
    resp, err := client.Do(req)
    if err != nil { panic(err) }
    defer resp.Body.Close()
    out, _ := io.ReadAll(resp.Body)
    fmt.Println(string(out))
}
Inspect

Example

A representative curl command for this scenario. Paste your own above to convert an exact match.

curl input
curl https://api.example.com/me \
  -H "X-API-Key: YOUR_KEY"

Implementation notes

  • The X-API-Key (or custom key header) name is preserved exactly as sent; case-sensitive gateways keep working.
  • Secrets are visible in the parsed request. Use the Clean panel's redact-and-diff flow before you paste the command anywhere.
  • Shareable links Base64-encode the input — they never leave your browser, and cleaned versions produce different links.

Common mistakes

  • Duplicating the key header (once via -H, once via a gateway middleware) — the generator warns when the same header appears twice.
  • Not rotating a leaked credential because "it's only in a screenshot" — screenshots get OCR'd, redact first.
  • Trusting HTTPS alone for API keys in query strings — proxies log URLs. Prefer headers, which the converter defaults to.

Common questions

How is API key rendered in Go?
The X-API-Key header (or any custom API-key header name) passes through unchanged to the generated code.
Can I redact the secret before sharing?
Yes. Open the Clean panel — Toolpaper detects Bearer tokens, Basic credentials, and common API-key patterns and replaces them with <REDACTED> in a diffable view.
Does anything leave my browser?
No. Parsing, redaction, and generation are 100% client-side.

More auth flows in Go

Go hub →

Bearer token in Go

/how-to/curl-bearer-auth-in-go

Basic auth in Go

/how-to/curl-basic-auth-in-go

The same guide in other languages

All guides →

In JavaScript

/how-to/curl-api-key-auth-in-javascript

In Node.js

/how-to/curl-api-key-auth-in-node

In Python

/how-to/curl-api-key-auth-in-python

In PHP

/how-to/curl-api-key-auth-in-php

In Ruby

/how-to/curl-api-key-auth-in-ruby

In Rust

/how-to/curl-api-key-auth-in-rust

In Java

/how-to/curl-api-key-auth-in-java

In Kotlin

/how-to/curl-api-key-auth-in-kotlin

Full Go reference on the cURL to Go hub, or open the main converter for all 18 targets.