Can a Private Proxy Accept Only Your Application?
Explain the limits of app-name and User-Agent restrictions and distinguish credential possession from proof of a particular executable.
A forward proxy can require credentials, restrict source networks, and apply destination policy. Those controls do not prove that the caller is one particular executable.
A User-Agent or custom header is supplied by the client and can be copied. An application name in a request is therefore unsuitable as the only gate to a private proxy.
Use access controls that express what you can actually validate: an authorized account, an allowed network location, and the intended destinations. Protect and revoke client credentials through the application's normal secret-handling design. Then verify permitted and denied requests against the intended access boundary.
Even stronger client authentication establishes possession of an approved key or credential. It should not be described as an absolute guarantee that no other program can use that credential.
If the requirement is managed-device or application integrity enforcement, identify that as an additional system requirement. Do not promise it from a Squid header rule that merely recognizes a string the caller chose to send.