Custom HTTP Headers: Forward any header, keep secrets safe
Stop scraping the logged-out version. Public values go in headers; secrets ride as x-api-header-* request headers and never touch the URL.
Microlink strips the x-api-header- prefix on the way out — the credential never lands in a URL.
Forward any HTTP header to the target page — Accept-Language, User-Agent, Cookie, Authorization, or any custom value. Same pattern across every Microlink output.
Two channels: headers for non-sensitive values that are safe in the URL; x-api-header-* for cookies, tokens, and other secrets — Microlink strips the prefix and forwards the original header to the target without ever logging the value into the public query string.
That's everything you need to reach logged-in dashboards, localized variants, A/B test cohorts, basic-auth staging environments, or any header-shaped page variant — without leaking credentials.
Public values stay public, secrets stay private
The split exists for one reason: query strings are publicly visible — in browser history, in server logs, in URL embeds — while HTTPS request headers are not. Pick the channel that matches the sensitivity of the value, and Microlink does the right thing on the way out.
Recommended: server-side, secrets in process env
Public values go in the second argument (headers); private ones go in MQL's third argument (httpOptions.headers) prefixed with x-api-header-. Both reach the target page; only secrets stay off the URL.
import mql from '@microlink/mql'
const { data } = await mql(
'https://example.com/dashboard',
{
screenshot: true,
meta: false,
headers: {
'accept-language': 'es-ES'
}
},
{
headers: {
'x-api-key': process.env.MICROLINK_API_KEY,
'x-api-header-cookie': `session=${process.env.SESSION_COOKIE}`,
'x-api-header-authorization': `Bearer ${process.env.AUTH_TOKEN}`
}
}
)Public values, private secrets.
Pick the volume that matches your traffic. Custom HTTP headers — both headers and x-api-header-* — are included on every Pro plan, across every workflow.
What is the difference between headers and x-api-header-*?
Can I forward cookies and authorization tokens?
cookie or authorization header to the target.Does this work for screenshots and PDFs too?
How do I keep API keys out of client-side code?
httpOptions) to pass x-api-key and any x-api-header-* values from environment variables.