Forwarded Headers
Learn how Pangolin forwards user identity information to your backend applications through HTTP headers
Pangolin can forward user identity information to your backend applications through custom HTTP headers. This allows your applications to receive user details directly from the request headers, enabling integration with Pangolin's authentication system. The same headers apply to public HTTP/HTTPS resources, private HTTP/HTTPS resources, and AI Gateway resources. For AI Gateway specifics, see Identity Headers.
Forwarded headers are only sent when Pangolin knows who the caller is — for example an authenticated public-resource session, or a connected Pangolin client on a private HTTP resource that maps to a user.
Supported Headers
Pangolin forwards the following headers to your backend when user identity is available:
| Header | Description | Example |
|---|---|---|
Remote-User | Unique username or user ID | user_123 |
Remote-Email | User's email address | john.doe@example.com |
Remote-Name | User's full name | John Doe |
Remote-Role | User's role or group membership | admin |
Public Resources
On public HTTP/HTTPS resources, headers depend on the authentication method.
Headers Available
These authentication methods provide user identity information and will include the forwarded headers:
Single Sign-On (SSO)
Full user identity information including username, email, and name.
Email-based One Time Passcode (OTP)
Only Remote-Email is provided, set to the whitelisted address the visitor authenticated with. Remote-User, Remote-Name, and Remote-Role are not available since there is no associated user account.
Shareable Links
Only available if the link was created with an associated user account. In that case, full user identity information is forwarded, the same as SSO. Links created without an associated user do not provide identity headers.
Headers Not Available
These authentication methods do not provide user identity information:
PIN Code
No user identity - only access control.
Password
No user identity - only access control.
Private HTTP
On private HTTP/HTTPS resources, identity comes from the connected Pangolin client, not from a public login page. When that client maps to a user, Pangolin forwards the same Remote-User, Remote-Email, Remote-Name, and Remote-Role headers to the upstream app. Access still comes from private resource grants (users, roles, and machines); the headers carry the identity once the client is already authorized.
Client Certificate (mTLS)
When mTLS is enabled on a public resource, verified client certificate details are forwarded in X-Forwarded-Tls-Client-Cert-Info (subject, issuer, serial number, validity, and SANs). That header is independent of the Remote-* identity headers above and is available whenever the TLS handshake succeeds with a trusted client certificate.
AI Gateway
AI Gateway resources forward the same Remote-User, Remote-Email, Remote-Name, and Remote-Role headers to the upstream model API when Pangolin knows the user:
- A public resource called with an identity key
- A public resource called with a manual key attributed to a user
- A private AI Gateway resource called from a connected Pangolin client
An unattributed manual key authenticates without sending these headers. Details are in Identity Headers.
Was this page helpful?