INTEGRITY Documentation

← Privacy Proxy / privacy-proxy / reference

HTTP headers

This page documents the HTTP headers used by Privacy Proxy for authentication, geolocation, and observability. For full observability details, refer to GraphQL Analytics API and OpenTelemetry.

Request headers

Clients include the following headers when connecting to Privacy Proxy.

Proxy-Authorization

Authenticates the client to the proxy. Required for all requests.

Pre-shared key format:

Proxy-Authorization: Preshared <key>

Privacy Pass token format:

Proxy-Authorization: PrivateToken token=<base64-encoded-token>
Parameter Description
<key> The pre-shared key provided by Cloudflare
<base64-encoded-token> A base64-encoded Privacy Pass token

GraphQL Analytics API request headers

When querying Privacy Proxy metrics via the GraphQL Analytics API, send a POST request to https://api.cloudflare.com/client/v4/graphql. For required headers and authentication details, refer to GraphQL Analytics API.

sec-ch-geohash

Specifies the client's geographic location for egress IP selection. Optional but recommended for accurate geolocation.

sec-ch-geohash: <geohash>-<country_code>
Parameter Description
<geohash> A geohash ↗ string (typically 4-8 characters)
<country_code> ISO 3166-1 alpha-2 country code
Example
sec-ch-geohash: u4pruydqqvj-GB

This example specifies a location in the United Kingdom.

Response headers

Privacy Proxy includes the following headers in responses.

Server-Timing

Provides timing information about proxy processing. This is part of the OpenTelemetry observability pipeline.

Server-Timing: proxy;dur=<milliseconds>
Parameter Description
<milliseconds> Processing time in milliseconds introduced by the proxy
Example
Server-Timing: proxy;dur=8.2

GraphQL Analytics API response headers

For response headers returned by the GraphQL API, refer to GraphQL Analytics API.

CONNECT request format

A complete CONNECT request to Privacy Proxy looks like this:

CONNECT example.com:443 HTTP/2
Host: example.com
Proxy-Authorization: Preshared abc123xyz
sec-ch-geohash: 9q8yy-US

The proxy responds with a status code indicating success or failure:

Status Meaning
200 OK Tunnel established successfully
403 Forbidden Authentication failed
502 Bad Gateway Could not connect to destination
503 Service Unavailable Proxy temporarily unavailable