How to Use HTTP Request Headers with C#

Working with Multiple Headers

When working with complex authentication scenarios or APIs, you often need to send multiple headers. Here's how to handle various header combinations:

using IronPdf;
using System.Collections.Generic;

var renderer = new ChromePdfRenderer();

// Configure multiple headers for API access
renderer.RenderingOptions.HttpRequestHeaders = new Dictionary<string, string>
{
    { "Authorization", "Bearer your-api-token" },
    { "Accept", "text/html,application/xhtml+xml" },
    { "Accept-Language", "en-US,en;q=0.9" },
    { "Cache-Control", "no-cache" },
    { "X-Custom-Header", "MyApplication/2.0" }
};

// Additional rendering options for better results
renderer.RenderingOptions.WaitFor.RenderDelay(500); // Wait for dynamic content
renderer.RenderingOptions.ViewPortWidth = 1920;
renderer.RenderingOptions.ViewPortHeight = 1080;

var pdf = renderer.RenderUrlAsPdf("https://api.example.com/report");
pdf.SaveAs("api-report.pdf");

using IronPdf;
using System.Collections.Generic;

var renderer = new ChromePdfRenderer();

// Configure multiple headers for API access
renderer.RenderingOptions.HttpRequestHeaders = new Dictionary<string, string>
{
    { "Authorization", "Bearer your-api-token" },
    { "Accept", "text/html,application/xhtml+xml" },
    { "Accept-Language", "en-US,en;q=0.9" },
    { "Cache-Control", "no-cache" },
    { "X-Custom-Header", "MyApplication/2.0" }
};

// Additional rendering options for better results
renderer.RenderingOptions.WaitFor.RenderDelay(500); // Wait for dynamic content
renderer.RenderingOptions.ViewPortWidth = 1920;
renderer.RenderingOptions.ViewPortHeight = 1080;

var pdf = renderer.RenderUrlAsPdf("https://api.example.com/report");
pdf.SaveAs("api-report.pdf");

Which HTTP Headers Are Most Commonly Used?

• Authorization: Sends authentication credentials (Bearer token, Basic auth, etc.)
• Content-Type: Defines the format of the request body (e.g., application/json)
• Accept: Specifies the expected response format (e.g., text/html, application/json)
• User-Agent: Identifies the client making the request (browser, API client, etc.)
• Referer: Indicates the page that linked to the current request
• Cookie: Sends cookies for session tracking

When using cookies for authentication, you can combine cookie headers with other authentication methods for enhanced security. The custom logging features in IronPDF can help you debug header-related issues during development.

When Should I Use Custom Headers?

Custom headers are essential when accessing protected resources that require authentication, working with APIs that expect specific headers, or when you need to identify your application to the server. They're particularly useful for rendering PDFs from authenticated web pages or API endpoints.

Common scenarios include:

• Accessing internal company dashboards behind authentication
• Generating reports from REST APIs that require API keys
• Converting authenticated SaaS application pages to PDF
• Working with microservices that use token-based authentication

Integration with Authentication Systems

IronPDF's header support works seamlessly with various authentication systems. For basic authentication scenarios:

using IronPdf;
using System;
using System.Text;

var renderer = new ChromePdfRenderer();

// Create Basic Auth header
string username = "user@example.com";
string password = "securepassword";
string credentials = Convert.ToBase64String(Encoding.UTF8.GetBytes($"{username}:{password}"));

renderer.RenderingOptions.HttpRequestHeaders = new Dictionary<string, string>
{
    { "Authorization", $"Basic {credentials}" }
};

// Render protected resource
var pdf = renderer.RenderUrlAsPdf("https://protected.example.com/report");
pdf.SaveAs("protected-report.pdf");

using IronPdf;
using System;
using System.Text;

var renderer = new ChromePdfRenderer();

// Create Basic Auth header
string username = "user@example.com";
string password = "securepassword";
string credentials = Convert.ToBase64String(Encoding.UTF8.GetBytes($"{username}:{password}"));

renderer.RenderingOptions.HttpRequestHeaders = new Dictionary<string, string>
{
    { "Authorization", $"Basic {credentials}" }
};

// Render protected resource
var pdf = renderer.RenderUrlAsPdf("https://protected.example.com/report");
pdf.SaveAs("protected-report.pdf");

What Happens If Headers Are Missing or Incorrect?

Missing or incorrect headers can result in 401 Unauthorized errors, 403 Forbidden responses, or incomplete page rendering. Always verify your header values match what the server expects, especially for authentication tokens and API keys.

To troubleshoot header issues, consider using IronPDF's debug features to examine the rendering process. Common problems include:

• Expired tokens or API keys
• Incorrect header formatting
• Missing required headers
• Case-sensitive header names being mistyped

Advanced Header Usage with Dynamic Content

When dealing with JavaScript-heavy pages that require authentication, combine headers with render delays:

:path=/static-assets/pdf/content-code-examples/how-to/http-request-header.cs

using IronPdf;
using System.Collections.Generic;

var renderer = new ChromePdfRenderer();
renderer.RenderingOptions.HttpRequestHeaders = new Dictionary<string, string>
{
    { "Authorization", "Bearer test-token-123" }
};

// Render PDF from authenticated page
var pdf = renderer.RenderUrlAsPdf("https://httpbin.org/bearer");
pdf.SaveAs("output.pdf");

Best Practices for Header Security

When working with sensitive authentication headers:

1. Never hardcode credentials: Store tokens and API keys in secure configuration
2. Use HTTPS URLs: Always render from HTTPS endpoints when sending authentication headers
3. Rotate tokens regularly: Implement token rotation for long-running applications
4. Validate SSL certificates: Ensure proper certificate validation for secure connections
5. Monitor header usage: Log header usage for security auditing

For additional security considerations, refer to the PDF permissions and passwords guide to protect your generated PDFs.

Integrating with Modern Web Applications

Modern single-page applications (SPAs) and progressive web apps (PWAs) often require specific headers for proper rendering. Here's how to handle OAuth 2.0 protected resources:

using IronPdf;
using System.Collections.Generic;
using System.Threading.Tasks;

public async Task<PdfDocument> GenerateOAuthProtectedPdf(string accessToken, string url)
{
    var renderer = new ChromePdfRenderer();

    // Configure OAuth headers
    renderer.RenderingOptions.HttpRequestHeaders = new Dictionary<string, string>
    {
        { "Authorization", $"Bearer {accessToken}" },
        { "Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8" }
    };

    // Set rendering options for SPAs
    renderer.RenderingOptions.WaitFor.RenderDelay(3000);
    renderer.RenderingOptions.EnableJavaScript = true;

    // Render and return the PDF
    return await Task.Run(() => renderer.RenderUrlAsPdf(url));
}

using IronPdf;
using System.Collections.Generic;
using System.Threading.Tasks;

public async Task<PdfDocument> GenerateOAuthProtectedPdf(string accessToken, string url)
{
    var renderer = new ChromePdfRenderer();

    // Configure OAuth headers
    renderer.RenderingOptions.HttpRequestHeaders = new Dictionary<string, string>
    {
        { "Authorization", $"Bearer {accessToken}" },
        { "Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8" }
    };

    // Set rendering options for SPAs
    renderer.RenderingOptions.WaitFor.RenderDelay(3000);
    renderer.RenderingOptions.EnableJavaScript = true;

    // Render and return the PDF
    return await Task.Run(() => renderer.RenderUrlAsPdf(url));
}

For more complex scenarios involving async operations, consider implementing retry logic for failed authentication attempts.

Conclusion

HTTP request headers in IronPDF provide a powerful way to access and convert authenticated web content to PDF. By properly configuring headers, you can seamlessly integrate PDF generation into your existing authentication workflows, whether you're working with simple API keys or complex OAuth systems. Remember to follow security best practices and leverage IronPDF's extensive rendering options for optimal results.