I put the secrets in environment variables, I don't what them to show up in the shell history anyway. Quoting can be a bit anything if you need nested quotes, but I hardly ever need that with curl.