Pick Ads
Add your product - start free

Updated October 20, 2026

Get HeaderSwap for Chrome

Home › Extensions › HeaderSwap for HTTP Headers › Guides › Modify request headers in Chrome

How to Modify HTTP Request Headers in Chrome

By the Pick Ads team · Tested on Chrome · Published October 20, 2026 · Updated October 20, 2026

Answer: Chrome DevTools can override response headers and the User-Agent, but it has no documented way to add arbitrary request headers. To add or change request headers like Authorization or a custom X- header, use an extension rule. Limit the rule to one domain, reload, and check the Headers tab in the Network panel.

Quick steps (HeaderSwap)

  1. Open HeaderSwap and create a profile.
  2. Add a request header with a name and value.
  3. Limit the profile to your domain.
  4. Reload the page and check Network > Headers.

Before you start

  • Time: about 5 minutes.
  • You need: Chrome and a site you're allowed to test.
  • Free vs Premium: Free covers this guide. Premium adds auto-expiry, sync and current-tab-only rules.

Method 1: what DevTools can do natively (and cannot)

TaskDevToolsWhere
Override response headersYesNetwork > right-click a request > Override headers
Override web contentYesNetwork > right-click > Override content
Change the User-AgentYesNetwork conditions panel > User agent
Add or change other request headersNot documented [VERIFY]-

Override a response header

  1. Open DevTools and go to Network.
  2. Right-click a request and choose Override headers.
  3. The first time, select a folder for override files and click Allow.
  4. In Headers > Response Headers, click Add header or edit a value.
  5. Refresh the page.

Chrome's documentation uses Access-Control-Allow-Origin: * as its example of removing a CORS error. Modified headers show in green (Override web content and HTTP response headers locally).

Limits: local overrides disable the cache, need a local folder, and only apply while DevTools is open. To change the User-Agent, open the Network conditions panel and untick Use browser default (Override the user agent string). For a full walkthrough, see override the User-Agent.

Method 2: with HeaderSwap

Add a rule

  1. Install HeaderSwap from the Chrome Web Store.
  2. Open the extension and create or select a profile, for example "Local".
  3. Add a request header with a name and value, for example X-Debug: 1, or choose a preset (Allow CORS, Disable cache, Mobile user agent, Remove CSP, Bearer token).
  4. Grant site access if Chrome prompts you.
  5. Reload the page.

Limit to a domain

Restrict the profile to a domain, a URL pattern or a regular expression, such as localhost or api.staging.example.com. Without a filter, the rule applies to all sites.

Request vs response headers

  • Request headers go from Chrome to the server: Authorization, Cookie, User-Agent, Referer, X- headers. Use them to authenticate, flag debug mode or test routing.
  • Response headers come back from the server: CORS, Content-Security-Policy, caching. Changing them affects how Chrome treats the response, not what the server did.

Verify in the Network tab

  1. Open DevTools > Network and reload.
  2. Select the request, then open Headers.
  3. Look under Request Headers or Response Headers. Use view source to see the raw order.

If you see "Provisional headers are shown", the request may have come from cache. Disable the cache and reload (Network features reference).

Common use cases

Use caseHeaderTypeGuide
Call a local API with a tokenAuthorization: Bearer <token>RequestAdd a bearer token
Test mobile renderingUser-Agent (Mobile preset)RequestOverride User-Agent
Unblock a dev-only CORS errorAccess-Control-Allow-Origin (Allow CORS preset)ResponseFix CORS errors
Flag debug or a featureX-Debug: 1, X-Feature: new-checkoutRequest-

Safety: limit scope, remove when done

  • Always use a domain filter. A global Authorization or Cookie header goes to every site you visit.
  • Use pause all when you're not testing.
  • Don't leave Remove CSP or Allow CORS on for normal browsing. They weaken protections sites rely on.
  • Premium auto-expiry (1h, 24h or 7d) removes temporary tokens for you.

Manifest V3 limits

HeaderSwap uses Chrome's declarativeNetRequest API. Chrome applies the rules, so the extension doesn't need to read traffic. That brings limits (declarativeNetRequest reference, updated 2026-09-11):

  • Operations are set, remove and append. Append works only for certain request headers.
  • If two extensions change the same header, Chrome's priority rules decide. Once one extension sets a header, others can't change it. Turn off other header extensions while testing.
  • Regex filters use RE2 syntax, ASCII only, with a cap of 1,000 regex rules.
  • Tab-specific rules exist only as session rules, which Chrome clears when it shuts down.

Troubleshooting

ProblemFix
Header not sentCheck the domain filter matches the request host, grant site access, reload.
Works on the page, not on API callsThe API is on another domain. Add it to the filter.
Another extension winsDisable other header extensions.
Old value appearsDisable cache in DevTools and reload.

What HeaderSwap does not do

  • It doesn't replace a server-side fix. CORS and security headers must be set correctly in production.
  • It doesn't read page content or network traffic, per its design.
  • Free covers up to 10 rules per profile and 2 profiles (per getpickads.com, 2026-10-20).

Last verified: 2026-10-20

Privacy: profiles stay on your device unless you turn on Premium sync. See the HeaderSwap privacy policy.

FAQ

Can DevTools change request headers? Not in general. Chrome documents overriding response headers and web content, and changing the User-Agent in the Network conditions panel. We found no documented way to add arbitrary request headers such as Authorization. For those, use an extension rule or set the header in your code or API client.

Does it affect other tabs? Yes, unless you scope it. A rule applies to every tab that loads a matching URL, so use a domain filter. Premium can apply a profile to the current tab only. Chrome supports tab-specific rules only as session rules, which are cleared when the browser shuts down.

Will headers persist after restart?

Is it safe on banking sites? Pause HeaderSwap or exclude those domains. HeaderSwap is designed not to read page content, but a global rule could still send test tokens or weaken CSP or CORS on sites you trust. Keep profiles limited to your development domains, and remove temporary tokens when done.

Add HeaderSwap to Chrome - Free

Sources

Last verified: 2026-10-20