Paste a curl command and get the fetch or axios call it stands for, with headers, JSON bodies and basic auth carried across.
The result appears here-X, -H, -d and its data variants, --json, -u for basic auth, -A for the user agent and -b for cookies. Transport flags such as --compressed, -L, -k and -s are ignored, since fetch decides those itself.
It becomes an Authorization header built with btoa, which is what curl sends on the wire. Move the credentials into an environment variable before the code goes anywhere near a repository.
Because a JSON body is parsed and written back as an object inside JSON.stringify, which is easier to edit than one long escaped string. A body that is not JSON stays a string exactly as it was.
Because curl is not a browser and never asks permission. A page's fetch is subject to the same-origin rule, so the server has to answer with Access-Control-Allow-Origin, and anything beyond a simple request gets a preflight first. Nothing in the translated code is wrong; the difference is who is asking.