Service eligibility and regional restrictions
PuppyIP serves only compliant overseas businesses and their authorized personnel. Proxy services are not available in mainland China. The service may only be used for lawful business activities outside mainland China. Use of this service within mainland China is prohibited.
Hosting a proxy IP or server overseas does not change these restrictions. The service must not be provided to end users in mainland China through relaying, forwarding, sharing or resale. Before use, read the Terms of Service.
Key Takeaways
- Cloudflare’s November 11 announcement confirms support in those two versions. The cf version is still labeled beta.
- CLOUDFLARE_API_HEADERS takes a JSON object of header names and string values. Names are case-insensitive, and configured values override existing headers, including authentication headers.
- Host, Content-Type, Content-Encoding, Content-Length, Connection, Transfer-Encoding, Upgrade, TE and Trailer are protected.
- The headers apply to requests the tools send to the Cloudflare API. They do not apply to local emulation or OAuth requests.
Check the version and request destination first
Cloudflare announced custom Cloudflare API request headers on November 11, 2026 for Wrangler 4.160.0 and Cloudflare CLI (cf) 1.0.0-beta.29. The cf version is a beta; its version number does not establish that a stable CLI 1.0 release has launched.
This setting targets requests the command-line tools send to the Cloudflare API. If you need to change Worker application requests, website response headers, OAuth login requests or local emulation traffic, check the relevant mechanism first. A tool reading an environment variable does not establish that every HTTP request uses it. The announcement and reference provide no separate fee, plan or country list for this feature; existing product permissions still apply.
Put header names and string values in one JSON object
The official reference requires CLOUDFLARE_API_HEADERS to be a JSON object mapping HTTP header names to string values. The examples below retain its non-sensitive X-Custom-Header: value example. They explain the syntax; this article did not execute the commands or test an account.
Bash/Zsh: export CLOUDFLARE_API_HEADERS='{"X-Custom-Header":"value"}'
PowerShell: $env:CLOUDFLARE_API_HEADERS = '{"X-Custom-Header":"value"}'
Wrangler or cf commands in the same environment can then read the variable. The outer single quotes preserve the JSON double quotes. Use JSON rather than a JavaScript object literal, and do not substitute unquoted numbers or booleans where string values are required. If CI behaves differently, first check whether the variable reaches the step running the tool rather than copying an environment snapshot containing real authentication values.
Why Host and Content-Type cannot be overridden
The reference explicitly protects nine headers: Host, Content-Type, Content-Encoding, Content-Length, Connection, Transfer-Encoding, Upgrade, TE and Trailer. They concern the request body or transport behavior and cannot be set through CLOUDFLARE_API_HEADERS.
Header names are case-insensitive, so changing the spelling to host or CONTENT-TYPE does not create a separate permission. Distinguish the application metadata you need from these protected headers. This article does not assume a specific error code for every invalid input or recommend rewriting headers to circumvent that boundary.
If authentication fails, check for an override
For configurable headers, values in the variable override existing values with the same name. Cloudflare explicitly includes authentication headers. A working authentication configuration can therefore be replaced by another value in the custom object; reviewing only the original API token configuration may miss the conflict.
Check locally whether the custom object contains an authentication header and whether it belongs on the intended request. A non-sensitive diagnostic label does not require overriding authentication as well. Keep the existing authorization scope, and keep real tokens out of articles, screenshots and public logs. Changing proxy egress does not correct an incorrect authentication value already sent or expand an account’s API permissions.
Validate within the supported scope, then remove temporary settings
Check the tool version, the environment visible to its process, JSON key and value types, protected names, authentication overrides, and finally whether the destination is the Cloudflare API. The reference excludes local emulation and OAuth requests. An unchanged request in either category does not by itself establish that the variable failed.
If you test the configuration yourself, choose an operation already authorized for your account and allowed by your existing change process, then record the actual response. Setting an environment variable successfully does not prove that the remote service received a header. Remove the temporary variable from the same shell or CI configuration when it is no longer needed. This article reviewed public documentation only; no deployment, API call, connectivity test, performance measurement or success-rate test was performed.
Sources
Frequently Asked Questions
Can this variable change all outgoing Worker requests and website response headers?
The announcement does not establish that behavior. CLOUDFLARE_API_HEADERS applies to requests Wrangler or cf sends to the Cloudflare API. Worker runtime traffic and website response headers use their own configuration mechanisms.
Will debug logging show every custom header value?
That is not guaranteed. The current Wrangler reference says WRANGLER_LOG_SANITIZE defaults to true, and header values outside the diagnostic allowlist remain redacted regardless of that setting. Do not disable protection to reveal real authentication values or treat a missing value in a sanitized log as proof that the request omitted the header.