Web page assets can send custom HTTP headers

If a dashboard you'd like on a screen needs a token to open, such as a private Grafana board, you can show it from Anthias 2026.07.2 without making it public. You add the token to the web page asset, and web pages that don't need one work as they did.

Pages like that expect the token in an HTTP header, like a Grafana dashboard that expects an Authorization header. A web page asset can now carry its own HTTP headers, so the page loads on the screen. It was asked for on GitHub in 2025.

Open a web page asset with "Edit" and fill in "Custom HTTP headers", one Name: Value per line, for example Authorization: Bearer <token>. Leave it empty for none.

The headers go only to the asset's own origin: the same scheme, host and port as the address you entered. The page's requests to anywhere else, including a redirect to another site or from https to http, go out without them, so a token can't leak to an ad or analytics server the page loads. An asset can have up to 20 headers. Lines that aren't a valid Name: Value pair are dropped when you save.

For developers

v2 asset responses include custom_headers, an object of header names to values, and you can write it on create and update. Writes are validated strictly: a bad name or value, or more than 20 headers, returns an error instead of being dropped. Only web page assets use it.