There's a couple of pieces to this.
If you are connecting to your API over an unencrypted connection then the username/password and everything else will be visible to people who can sniff the traffic. Things like HTTP Digest authentication will make things a bit more difficult but ultimately there's still a vulnerability there. If (for whatever reason) you can't use SSL HTTP Digest is better than HTTP basic.
Assuming you set-up SSL to protect information in transit, the visibility of creds will depend on how you configure things.
If you set your proxy up to be something like fiddler and you set it to intercept SSL connections, then when the data passes fiddler it will be visible there, otherwise it should not be visible.
One thing to note in all this is that it shouldn't matter what client-side tool you're using here (cURL/wget/a browser) the security is configured on the server-side.