Skip to main content
Available on Enterprise plans as an add-on.
Some sources sit behind an access gateway, such as Cloudflare Access, that rejects any request without a service token in its headers. Set those headers once on the source and Deck’s browser attaches them to every request to the source’s host before the first navigation. Once the gateway lets the browser through, the run continues with the credential’s normal login. Headers apply to every credential, task, and run against the source. They are only sent to the source’s host.

​
Setting headers

Headers can be set from the source’s detail page in the Console or through the API. Over the API, pass a headers object on POST /sources or PATCH /sources/{source_id}. values maps header names to values. tokenized names the values that are secret, the same way tokenized source fields work on credentials.
Tokenized values are vaulted and never returned. When you retrieve the source, they are removed from values and only their names appear in tokenized. Non-tokenized values are returned in the clear. headers is omitted when none are set.

​
Rotating and removing headers

On PATCH, headers replaces the whole set, so rotate a token by sending the full object again. Send "headers": null to remove all headers, or omit the field to leave them unchanged. Deck can’t see when a token expires, so rotating it before then is up to you.

​
Limits

Any of the following returns invalid_field_value:
  • More than 10 headers on a source, a name that is not a valid HTTP header name, or a value that is not a string.
  • An entry in tokenized that doesn’t name a key in values.
  • A header the browser manages: Host, Cookie, Content-Length, Connection, Transfer-Encoding, User-Agent, Origin, or Referer.
Setting headers before the feature is enabled for your organization returns feature_not_available.