HTTP headers

This page documents the HTTP headers used by Privacy Proxy for authentication, geolocation, and observability. For full observability details, refer to GraphQL Analytics API and OpenTelemetry.

Clients include the following headers when connecting to Privacy Proxy.

Authenticates the client to the proxy. Required for all requests.

Pre-shared key format:

Proxy-Authorization: Preshared <key>

Privacy Pass token format:

Proxy-Authorization: PrivateToken token=<base64-encoded-token>

When querying Privacy Proxy metrics via the GraphQL Analytics API, send a POST request to https://api.cloudflare.com/client/v4/graphql. For required headers and authentication details, refer to GraphQL Analytics API.

Specifies the client's geographic location for egress IP selection. Optional but recommended for accurate geolocation.

sec-ch-geohash: <geohash>-<country_code>

sec-ch-geohash: u4pruydqqvj-GB

This example specifies a location in the United Kingdom.

Privacy Proxy includes the following headers in responses.

Provides timing information about proxy processing. This is part of the OpenTelemetry observability pipeline.

Server-Timing: proxy;dur=<milliseconds>

Server-Timing: proxy;dur=8.2

For response headers returned by the GraphQL API, refer to GraphQL Analytics API.

A complete CONNECT request to Privacy Proxy looks like this:

CONNECT example.com:443 HTTP/2
Host: example.com
Proxy-Authorization: Preshared abc123xyz
sec-ch-geohash: 9q8yy-US

The proxy responds with a status code indicating success or failure: