HTTP Headers for APIs: Content-Type, Authorization, Cache-Control, and More

HTTP headers carry metadata about requests and responses.

Duck Cloud's HTTP Header Checker inspects public response headers.

Content-Type

Content-Type describes the response body.

A JSON API commonly returns:

Content-Type: application/json

If a client expects JSON but gets text/html, it may have received a login page, proxy error, or framework error page.

Accept

Accept describes response formats the client prefers.

Do not confuse it with Content-Type.

Authorization

APIs often use the Authorization header for bearer tokens or other credentials.

Never log live access tokens.

Cache-Control

Cache-Control affects how responses may be cached. Authentication-sensitive responses require careful caching rules.

Location

Redirect responses often use Location. Use Redirect Checker to trace multiple hops.

Retry-After

A service may provide Retry-After with rate limiting or temporary unavailability.

Use HTTP Status Code Lookup when interpreting status codes such as 429.

CORS

Browser JavaScript may be blocked by CORS even when curl or Postman works. Inspect relevant response headers and configure allowed origins deliberately.

Debugging workflow

1. Record status code.
2. Inspect Content-Type.
3. Check redirects.
4. Verify auth scheme.
5. Review cache headers.
6. Check CORS for browser-only failures.
7. Preserve the raw response.
8. Use request IDs with server logs.

Headers often reveal the failing layer before you even inspect the body.