> ## Documentation Index
> Fetch the complete documentation index at: https://docs.deck.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Custom source headers

> Attach a service token or other fixed headers to every request Deck makes to a source.

<Note>
  Available on Enterprise plans as an add-on.
</Note>

Some sources sit behind an access gateway, such as Cloudflare Access, that rejects any request without a service token in its headers. Set those headers once on the source and Deck's browser attaches them to every request to the source's host before the first navigation. Once the gateway lets the browser through, the run continues with the credential's normal login.

Headers apply to every credential, task, and run against the source. They are only sent to the source's host.

## Setting headers

Headers can be set from the source's detail page in the [Console](https://console.deck.co) or through the API. Over the API, pass a `headers` object on [`POST /sources`](/api-reference/sources/create-a-source) or [`PATCH /sources/{source_id}`](/api-reference/sources/update-a-source). `values` maps header names to values. `tokenized` names the values that are secret, the same way [tokenized source fields](/concepts/credentials#tokenizing-source-fields) work on credentials.

```json theme={null}
{
  "type": "website",
  "website": { "url": "https://portal.example.com" },
  "headers": {
    "values": {
      "CF-Access-Client-Id": "a1b2c3.access",
      "CF-Access-Client-Secret": "..."
    },
    "tokenized": ["CF-Access-Client-Secret"]
  }
}
```

Tokenized values are vaulted and never returned. When you retrieve the source, they are removed from `values` and only their names appear in `tokenized`. Non-tokenized values are returned in the clear. `headers` is omitted when none are set.

```json theme={null}
{
  "id": "src_AbC123xYz456",
  "object": "source",
  "name": "Acme Portal",
  "type": "website",
  "website": { "url": "https://portal.example.com" },
  "headers": {
    "values": { "CF-Access-Client-Id": "a1b2c3.access" },
    "tokenized": ["CF-Access-Client-Secret"]
  },
  "created_at": "2026-08-24T12:00:00Z",
  "updated_at": "2026-08-24T12:00:00Z",
  "request_id": "req_a1b2c3d4"
}
```

## Rotating and removing headers

On `PATCH`, `headers` replaces the whole set, so rotate a token by sending the full object again. Send `"headers": null` to remove all headers, or omit the field to leave them unchanged. Deck can't see when a token expires, so rotating it before then is up to you.

## Limits

Any of the following returns `invalid_field_value`:

* More than 10 headers on a source, a name that is not a valid HTTP header name, or a value that is not a string.
* An entry in `tokenized` that doesn't name a key in `values`.
* A header the browser manages: `Host`, `Cookie`, `Content-Length`, `Connection`, `Transfer-Encoding`, `User-Agent`, `Origin`, or `Referer`.

Setting `headers` before the feature is enabled for your organization returns `feature_not_available`.