--- title: Drop-in API gateway policy examples for manipulating headers description: A collection of ready-to-use ngrok Traffic Policy YAML examples focused on manipulating HTTP headers at the API gateway level. Covers rewriting Host headers to... canonical: https://daily.dev/posts/drop-in-api-gateway-policy-examples-for-manipulating-headers-zh8fd6jdo twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Drop-in API gateway policy examples for manipulating headers | daily.dev og:description: A collection of ready-to-use ngrok Traffic Policy YAML examples focused on manipulating HTTP headers at the API gateway level. Covers rewriting Host headers to... og:url: https://daily.dev/posts/drop-in-api-gateway-policy-examples-for-manipulating-headers-zh8fd6jdo og:image: https://api.daily.dev/og/posts/ZH8fd6JdO.png og:image:alt: Drop-in API gateway policy examples for manipulating headers og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Drop-in API gateway policy examples for manipulating headers **[ngrok Blog](https://daily.dev/sources/ngrok)** · 8 min read · 0 upvotes · 0 comments ## Summary A collection of ready-to-use ngrok Traffic Policy YAML examples focused on manipulating HTTP headers at the API gateway level. Covers rewriting Host headers to match upstream services, stripping sensitive infrastructure details from response headers, injecting tracing/logging headers, trimming headers to cut logging costs, adding SLA-tier headers with CEL-based timing metrics, building geo-aware services via headers, and chaining actions using action result variables for follow-up logic like per-tier rate limiting. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I fix errors caused by the Host header when ngrok sits in front of my upstream service? Rewrite the Host header at the gateway so it matches what the upstream server expects. When traffic passes through ngrok, requests arrive with a Host header like foo.ngrok.dev, and if the upstream server only handles its own configured hostname, it returns an error; using ngrok's Traffic Policy add-headers and remove-headers actions to replace the Host header keeps requests flowing without touching server config. _daily.dev surfaces practical gateway configuration fixes like this for engineers debugging routing errors._ ### How can I hide information like X-Powered-By or ETag headers from API responses? Use a gateway-level remove-headers policy to strip them before responses reach end users. Frameworks like Express automatically add headers such as X-Powered-By: Express, and proxies like ngrok add their own metadata such as ETag and agent IP; applying a remove-headers action in a Traffic Policy rule lets you control exactly which headers are exposed externally. _Engineers hardening API responses can find similar header-hardening techniques on daily.dev._ ### How do I add SLA metrics like response time to API responses for specific customers? Combine IP-range matching with CEL expression interpolation in a gateway policy to tag requests and measure duration. A rule can add an x-sla-tier: platinum header to requests from known customer IP ranges using an inCidrRanges macro, then calculate response duration on the way out by comparing the current time to when the connection began, giving customers visibility into service performance. _daily.dev helps developers building customer-facing SLAs compare gateway-level metric strategies._ ## Similar posts on daily.dev - [AWS ALBs Now Support Native URL and Host Header Rewriting](https://daily.dev/posts/aws-albs-now-support-native-url-and-host-header-rewriting-pcpzxll2q) · InfoQ · 0 upvotes · 0 comments --- Tags: [#devtools](https://daily.dev/tags/devtools), [#api-gateway](https://daily.dev/tags/api-gateway) [View this post on daily.dev](https://daily.dev/posts/drop-in-api-gateway-policy-examples-for-manipulating-headers-zh8fd6jdo) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Drop-in API gateway policy examples for manipulating headers","url":"https://daily.dev/posts/drop-in-api-gateway-policy-examples-for-manipulating-headers-zh8fd6jdo","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/drop-in-api-gateway-policy-examples-for-manipulating-headers-zh8fd6jdo"},"datePublished":"2026-08-23T07:20:31.818Z","dateModified":"2026-08-23T07:24:49.955Z","description":"A collection of ready-to-use ngrok Traffic Policy YAML examples focused on manipulating HTTP headers at the API gateway level. Covers rewriting Host headers to...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/4b44d7a6f353ede2637ff22efaf2702d?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/4b44d7a6f353ede2637ff22efaf2702d?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"ngrok Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"ngrok Blog","logo":"https://media.daily.dev/image/upload/s--718XXxvE--/f_auto,q_auto/v1787469610/logos/ngrok?_a=BAMAMicg0","url":"https://daily.dev/sources/ngrok"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/drop-in-api-gateway-policy-examples-for-manipulating-headers-zh8fd6jdo","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"devtools,api-gateway","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"ngrok Blog","item":"https://daily.dev/sources/ngrok"},{"@type":"ListItem","position":3,"name":"Drop-in API gateway policy examples for manipulating headers"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/drop-in-api-gateway-policy-examples-for-manipulating-headers-zh8fd6jdo#faq","mainEntity":[{"@type":"Question","name":"How do I fix errors caused by the Host header when ngrok sits in front of my upstream service?","acceptedAnswer":{"@type":"Answer","text":"Rewrite the Host header at the gateway so it matches what the upstream server expects. When traffic passes through ngrok, requests arrive with a Host header like foo.ngrok.dev, and if the upstream server only handles its own configured hostname, it returns an error; using ngrok's Traffic Policy add-headers and remove-headers actions to replace the Host header keeps requests flowing without touching server config. daily.dev surfaces practical gateway configuration fixes like this for engineers debugging routing errors."}},{"@type":"Question","name":"How can I hide information like X-Powered-By or ETag headers from API responses?","acceptedAnswer":{"@type":"Answer","text":"Use a gateway-level remove-headers policy to strip them before responses reach end users. Frameworks like Express automatically add headers such as X-Powered-By: Express, and proxies like ngrok add their own metadata such as ETag and agent IP; applying a remove-headers action in a Traffic Policy rule lets you control exactly which headers are exposed externally. Engineers hardening API responses can find similar header-hardening techniques on daily.dev."}},{"@type":"Question","name":"How do I add SLA metrics like response time to API responses for specific customers?","acceptedAnswer":{"@type":"Answer","text":"Combine IP-range matching with CEL expression interpolation in a gateway policy to tag requests and measure duration. A rule can add an x-sla-tier: platinum header to requests from known customer IP ranges using an inCidrRanges macro, then calculate response duration on the way out by comparing the current time to when the connection began, giving customers visibility into service performance. daily.dev helps developers building customer-facing SLAs compare gateway-level metric strategies."}}]} ```