Custom Request Headers

Send custom HTTP headers with every check — bearer tokens, User-Agents, host overrides. Validated as JSON, 4 kB cap.

Custom Request Headers

Send extra HTTP headers with every check so LemWatch can reach endpoints that need authentication, a specific User-Agent, or a host override.

Format

A JSON object — keys are header names, values are strings.

Rules

• Must be valid JSON parsable as an object (not an array, not a bare string)
• Max 4,000 characters total
• Header names and values are sent verbatim — no escaping applied
• Empty string "" is treated as "no custom headers"

Common patterns

Protect a staging environment

Allowlist past your WAF

Pin a CDN edge

Security

Headers are stored encrypted at rest. They are visible in the audit log to admins of your organization. Rotate any token if a teammate leaves.

Troubleshooting

• "Custom headers must be a valid JSON object" — your value is missing braces, has a trailing comma, or is an array
• Auth header ignored — confirm the upstream actually accepts the header name (some WAFs strip Authorization)
• Headers gone after save — make sure you're on the latest build; older releases dropped this field due to a Zod schema gap