CURLOPT_USERPWD(3)

💖 CURLOPT_USERPWD(3) 💖

okay so this is a page from the Library Functions Manual (libcurl, obviously, the manual for library functions, keep up bestie) and it's all about CURLOPT_USERPWD — literally the "username and password to use in authentication" option. yes that's the NAME section, we're doing this properly ✨

---

🌸 SYNOPSIS 🌸

#include <curl/curl.h>

CURLcode curl_easy_setopt(CURL *handle, CURLOPT_USERPWD, char *userpwd);

---

🎀 DESCRIPTION 🎀

So you pass a char pointer as the parameter, and it points at a null-terminated login details string for the connection. The format is, and I cannot stress this enough:

[username]:[password]

That's it. That's the whole vibe. 💅

Now, some specifics, because the details matter:

• When you're using Kerberos V5 authentication with a Windows based server, you should specify the username part with the domain name, so the server can successfully obtain a Kerberos Ticket. If you don't do that, then the initial part of the authentication handshake may fail. 😭 not the handshake failing on you
• When using NTLM, the username can be specified simply as the username without the domain name, should the server be part of a single domain and forest. lowkey convenient ngl
• To specify the domain name, use either Down-Level Logon Name or UPN (User Principal Name) formats. For example EXAMPLEser and user@example.com respectively. those are the literal example strings, don't @ me 🦋
• Some HTTP servers (on Windows) support inclusion of the domain for Basic authentication as well. okay so that's a thing 👑

Here's a big one, pay attention bestie: when using HTTP and CURLOPT_FOLLOWLOCATION(3), libcurl might perform several requests to possibly different hosts. libcurl only sends this user and password information to hosts using the initial hostname (unless CURLOPT_UNRESTRICTED_AUTH(3) is set), so if libcurl follows redirects to other hosts, it does not send the user and password to those. This is enforced to prevent accidental information leakage. 🫶 we love a security-conscious icon

• Use CURLOPT_HTTPAUTH(3) to specify the authentication method for HTTP based connections, or CURLOPT_LOGIN_OPTIONS(3) to control IMAP, POP3 and SMTP options.
• The user and password strings are not URL decoded, so there is genuinely no way to send in a username containing a colon using this option. Use CURLOPT_USERNAME(3) for that, or include it in the URL. periodt 💀
• The application does not have to keep the string around after setting this option. set it and forget it energy ✨
• Using this option multiple times makes the last set string override the previous ones. Set it to NULL to disable its use again. last one wins, no cap 🏆

---

💜 DEFAULT 💜

NULL

(yeah. nothing. no auth. empty. the void. 🕳️)

---

🌈 PROTOCOLS 🌈

This functionality affects all supported protocols. every single one. main character energy fr fr 👑

---

🍓 EXAMPLE 🍓

int main(void)
{
  CURL *curl = curl_easy_init();
  if(curl) {
    CURLcode result;
    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/foo.bin");

    curl_easy_setopt(curl, CURLOPT_USERPWD, "clark:kent");

    result = curl_easy_perform(curl);

    curl_easy_cleanup(curl);
  }
}

ok so clark:kent… that's literally Superman's login 😭 iconic choice of example credentials ngl 🦸‍♂️

---

⭐ AVAILABILITY ⭐

Added in curl 7.1 — vintage. retro. a classic. 🎀

---

🦋 RETURN VALUE 🦋

curl_easy_setopt(3) returns a CURLcode indicating success or error.

CURLE_OK (0) means everything was OK 👌, non-zero means an error occurred 😭 — see libcurl-errors(3) for the whole dramatic list.

---

🔥 SEE ALSO 🔥

• CURLOPT_PASSWORD(3)
• CURLOPT_PROXYUSERPWD(3)
• CURLOPT_USERNAME(3)

go read those too, they're the friend group 🫶

---

✨ that's the whole page bestie, you're officially auth-literate ✨

and yes, this was libcurl manual page CURLOPT_USERPWD(3), dated 2026-10-12 — mwah, catch you in the next manpage 💋🌸