> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ctrlrun.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# HeaderIdentityProvider

> The principal named by a trusted HTTP header (§3.3).

`ctrlrun.HeaderIdentityProvider` — class, defined at `src/ctrlrun/identity.py:126`

```python theme={null}
class HeaderIdentityProvider()
    def __init__(agent_header: str, user_header: str | None, issuer: str | None)
```

The principal named by a trusted HTTP header (§3.3).

**A trusted header is worth exactly what the thing that sets it is worth.** This is correct
behind a proxy that authenticates the caller and *overwrites* the header on every request,
and worthless anywhere else: if the agent can set the header, the agent chooses its own
authority. RFC 7239 §8.1 says the same of the header it standardizes — it "cannot be relied
upon to be correct, as it may be modified ... by every node on the way to the server,
including the client making the request".

It carries no claims. A header is a name; manufacturing claims from one would be inventing
verified data, which is the one thing this module must not do.

## Next

* [Python API index](/reference/api/index).
* [Get started](/get-started/quickstart) · [Why](/why).


## Related topics

- [Authority and delegation](/concepts/authority-and-delegation.md)
- [Roadmap](/ROADMAP.md)
- [ctrlrun verify](/verify.md)
- [Threat model](/THREAT_MODEL.md)
- [Python API](/reference/api/index.md)