Can Chrome DevTools add a request header?

Not to the page's own requests. DevTools can override response headers (Sources > Overrides) and change the user agent (Network conditions), but it has no setting to add an arbitrary header to every request a page makes.

How do I add an Authorization header to requests in Chrome?

For a single API call, send it yourself with fetch in the console or with curl. For every request a page makes, use a header-modifying extension with a rule that sets Authorization for that site only.

Is it safe to use an extension to modify headers?

It is as safe as the extension. Prefer one that runs locally, sends no data anywhere, and limits rules to the sites you choose. ModHeader, the best-known tool, was removed from the Chrome Web Store in 2026.

Why is my custom header not being sent?

Common causes: the rule doesn't match the request URL, it is scoped to a different tab or domain, or the header is added to a cross-origin request and the server's CORS preflight doesn't allow it in Access-Control-Allow-Headers.

How to add a custom header to requests in Chrome

You need every request to carry a header — an Authorization token, an X-Api-Key, a feature flag, a different Accept-Language — while you test in a real browser. Here's what Chrome can do on its own, and how to do the rest.

On this page

What DevTools can and can't do
One request: the console
Every request a page makes: a header rule
Checking the header was really sent
When the header isn't sent

What DevTools can and can't do

Want to	Built into Chrome?
Change the User-Agent	Yes — DevTools → Network conditions (how)
Override a response header	Yes — DevTools → Sources → Overrides, then right-click a request in Network → Override headers
Add a request header to the page's own requests	No

One request: the console

For a single API call, send it yourself from the DevTools console on the site's own tab, so cookies and origin are right:

const res = await fetch("/api/me", {
  headers: { "Authorization": "Bearer eyJhbGciOi...", "X-Feature-Flag": "new-checkout" }
});
console.log(res.status, await res.json());

Or from a terminal: curl -H "Authorization: Bearer …" https://api.example.com/me. Neither affects the page's own requests.

Every request a page makes: a header rule

To make the page itself send the header — every fetch, XHR, image and navigation — you need a rule in the browser that rewrites requests before they leave. Extensions do this through Chrome's declarativeNetRequest API. What to look for:

Scope: limit the rule to the domains you're testing, so your token never goes to other sites.
Proof it fired: silent tools leave you guessing whether the rule even matched.
Local only: a header tool sees your tokens. It should send nothing anywhere.

HeaderForge (Chrome, free)

Set or remove any request or response header, for all sites, chosen domains or just this tab. It shows when a rule actually fired, works on fetch, XHR and POST, and has presets for User-Agent, no-cache, X-Forwarded-For and removing CSP or X-Frame-Options. Imports ModHeader exports. No account, no analytics.

Get HeaderForge for Chrome

Checking the header was really sent

Open DevTools → Network and reload.
Click a request and open Headers → Request Headers.
If you see "Provisional headers are shown", the list is incomplete — tick Disable cache and reload, or check what the server received in its logs.

When the header isn't sent

The rule doesn't match the URL — check the pattern against the exact request URL, including the port.
The request is cross-origin and the header isn't a simple one, so the browser sends a preflight first; the server must list it in Access-Control-Allow-Headers or the real request never goes. See CORS errors.
A service worker answered from cache, so no network request happened. Tick Bypass for network under Application → Service workers.

More on this topic: HTTP headers list: the request and response headers that matter · Referer header: what it sends, why it's empty, and how to change it · Cache-Control header explained: max-age, no-cache, no-store and more · iframe "refused to connect": what causes it and how to fix it