> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.pensar.dev/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.pensar.dev/_mcp/server.

# Custom Headers

> Add custom HTTP headers to penetration testing requests

## Overview

Custom headers allow you to configure HTTP headers that are automatically included with every request during penetration testing. This is essential for authentication and useful for tracking Pensar's requests in your network logs.

## Use Cases

#### Authentication

Add API keys, bearer tokens, or custom auth headers to access protected endpoints.

#### Request Tracking

Include identifiers to filter and monitor Pensar's requests in your logs and monitoring tools.

#### Environment Routing

Add headers required by your infrastructure for routing to specific environments or backends.

#### Feature Flags

Include headers that enable specific features or test configurations in your application.

## Configuring Custom Headers

#### Navigate to Environment Settings

In your workspace, go to **Settings** → **Agent Configuration** → **Environment**.

#### Add a Header

Enter the header name and value in the input fields:

* **Header Name**: The HTTP header name (e.g., `Authorization`, `X-API-Key`)
* **Header Value**: The value for the header (e.g., `Bearer your-token-here`)

Click **Add** to save the header.

#### Manage Headers

View all configured headers in the table. Click the **X** button to remove a header (you'll be asked to confirm deletion).

## Common Examples

### Authentication Headers

```
Authorization: Bearer iOiJIUzI1NiIsInR5csCI6IkpXVCJ9...
```

```
X-API-Key: your-api-key-here
```

### Request Tracking

Add a custom header to identify Pensar's requests in your logs:

```
X-Pensar-Test: security-scan-2024
```

```
X-Request-Source: pensar-pentest
```

This makes it easy to:

* Filter Pensar's requests in your log aggregation tools
* Exclude test traffic from analytics
* Monitor scan activity in real-time
* Correlate findings with specific requests

## How It Works

Custom headers are merged with the default headers for every HTTP request the agent makes:

1. Your custom headers are loaded when the scan starts
2. Each `http_request` tool call includes your headers automatically
3. Command-line tools (curl, etc.) also include the headers when applicable

> **Info**
>
> Custom headers are applied in addition to the default `User-Agent: pensar-apex` header. If you specify a custom `User-Agent`, it will override the default.