How to Add an Authorization Header in Chrome (Without Touching Your Code)

Every developer has been there: you’re testing an API endpoint, the server requires an Authorization header, and you just want to hit the URL directly in your browser — no Postman, no curl, no code change. This guide shows you the fastest way to do it.

Why You Can’t Just Add Authorization Headers in the Browser URL Bar

Chrome, like all browsers, doesn’t expose a native UI for adding request headers. When you type a URL into the address bar, the browser sends a default set of headers — Host, User-Agent, Accept — and that’s it. There’s no built-in way to attach a Bearer token or Basic credentials to those requests.

Your options are:

• Use a dedicated API client like Postman or Insomnia
• Use curl or httpie in the terminal
• Use a Chrome extension that injects headers into your browser requests

The third option is the most convenient when you’re working in the browser and switching between tabs, debugging responses in DevTools, or sharing a testing environment with teammates.

The Authorization Header: A Quick Refresher

Before we get to the how-to, a quick recap of the two most common authorization header formats:

Bearer Token (OAuth 2.0, JWT)

Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...

Basic Auth (username:password, base64-encoded)

Authorization: Basic dXNlcm5hbWU6cGFzc3dvcmQ=

Both are just HTTP request headers — a key-value pair sent with every request matching your rule.

How to Add an Authorization Header Using DevHeaders

DevHeaders is a Chrome extension built specifically for managing HTTP request headers. Here’s how to set up an Authorization header in under two minutes.

Step 1: Install DevHeaders

Install DevHeaders from the Chrome Web Store. Click Add to Chrome and confirm the permissions prompt.

Step 2: Open the Extension and Create a Rule

Click the DevHeaders icon in your Chrome toolbar. Hit Add rule.

Step 3: Configure the Header

Fill in the rule fields:

The URL pattern uses glob syntax — * matches any path, so https://api.example.com/* will apply the header to every request to that domain.

Step 4: Enable the Rule and Test

Toggle the rule on. Open DevTools (F12), go to the Network tab, and make a request to your API. Click on the request and check the Headers section — you’ll see your Authorization header listed under Request Headers.

Scoping Rules to Specific Environments

The real power of header rules is environment scoping. Instead of manually swapping tokens when switching between staging and production, create two rules:

Rule 1: https://api-staging.yourservice.com/* → Authorization: Bearer STAGING_TOKEN
Rule 2: https://api.yourservice.com/*         → Authorization: Bearer PROD_TOKEN

Only the matching rule fires. You can toggle them independently without touching your application code.

Sharing Authorization Rules with Your Team

If you’re working in a team environment, hardcoding tokens into each developer’s browser is fragile. DevHeaders supports profile export — you can share a configuration file with your team so everyone uses the same header rules for a given project or environment.

Common Use Cases

• JWT debugging — inject a token that’s about to expire to test your app’s refresh logic
• API gateway testing — add an x-api-key header to every request to a specific domain
• Internal tools — access internal services that require Authorization without modifying proxy settings
• QA automation prep — verify header-dependent behavior manually before writing automated tests

Frequently Asked Questions

Is it safe to store tokens in a Chrome extension? DevHeaders stores rules locally in chrome.storage.sync — your tokens never leave your browser unless you explicitly export a profile. Don’t store production secrets in any browser extension if you’re on a shared machine.

Will the Authorization header be sent to all websites? No. Rules are scoped to URL patterns you define. A rule for https://api.example.com/* will not affect requests to any other domain.

Does this work with Chrome DevTools’ Network conditions? Yes. Headers added by DevHeaders appear in the Network panel just like any other request header, so you can inspect them normally.

DevHeaders is a free Chrome extension for managing HTTP request headers. Install it from the Chrome Web Store and stop copy-pasting tokens into Postman.