HTTP Header List
Every HTTP header you'll meet in practice, what it does, and an example value. Need to send one? Grab a ready-made curl command and convert it to any language.
Request headers
| Header | What it does | Example |
|---|---|---|
| Authorization | Credentials for authenticated requests (Bearer tokens, Basic auth). | Bearer eyJhbGci... |
| Accept | Content types the client can handle. | application/json |
| Accept-Encoding | Compression algorithms the client supports. | gzip, br |
| Accept-Language | Preferred natural languages. | en-US,en;q=0.9 |
| Cache-Control | Caching directives for this request. | no-cache |
| Connection | Keep the connection alive or close it. | keep-alive |
| Content-Type | Media type of the request body. | application/json |
| Content-Length | Size of the body in bytes. | 128 |
| Cookie | Cookies previously set by the server. | session=abc123 |
| Host | Domain name of the server (required in HTTP/1.1). | api.example.com |
| If-None-Match | Makes the request conditional on the ETag changing. | "abc123" |
| If-Modified-Since | Conditional request based on last modification date. | Wed, 21 Oct 2025 07:28:00 GMT |
| Origin | Origin of a cross-origin request (CORS). | https://example.com |
| Referer | URL of the page that led to this request. | https://example.com/page |
| User-Agent | String identifying the client software. | Mozilla/5.0 ... |
| X-Forwarded-For | Client IP when behind a proxy/load balancer. | 203.0.113.45 |
| X-Forwarded-Proto | Original protocol (http/https) used by the client. | https |
| X-Api-Key | Common convention (non-standard) for API key auth. | sk_live_... |
| X-Request-ID | Correlation ID for tracing a request through services. | 4f9ad8d0 |
Response headers
| Header | What it does | Example |
|---|---|---|
| Access-Control-Allow-Origin | Which origins may read the response (CORS). | * or https://example.com |
| Age | How long the response has been in a cache. | 3600 |
| Cache-Control | Caching directives for the response. | max-age=3600, private |
| Content-Disposition | Suggests a filename / inline vs attachment. | attachment; filename="report.pdf" |
| Content-Encoding | Compression applied to the body. | gzip |
| Content-Type | Media type of the response body. | application/json; charset=utf-8 |
| ETag | Version identifier for caching validation. | "v1.2" |
| Expires | Date after which the response is stale. | Thu, 01 Jan 2026 00:00:00 GMT |
| Last-Modified | Date the resource last changed. | Wed, 21 Oct 2025 07:28:00 GMT |
| Location | Redirect target (used with 3xx) or new resource URI (201). | https://api.example.com/users/42 |
| Retry-After | How long the client should wait before retrying. | 30 |
| Set-Cookie | Sets a cookie on the client. | session=abc123; HttpOnly; Secure |
| Strict-Transport-Security | Forces HTTPS for future requests (HSTS). | max-age=31536000 |
| Vary | Which request headers affect the cached variant. | Accept-Encoding |
| WWW-Authenticate | Auth scheme required (sent with 401). | Bearer realm="api" |
| X-RateLimit-Remaining | Common convention for API rate limit info. | 57 |
Try any header in code
Paste this into the converter to see it in Python, JavaScript, Go and more:
curl https://api.example.com/data \ -H 'Authorization: Bearer YOUR_TOKEN' \ -H 'Accept: application/json' \ -H 'X-Request-ID: demo-123'