Put Go’s CONNECT Headers on the Transport

A header added to http.Request.Header describes the destination request. When HTTPS uses an HTTP proxy, the transport first performs CONNECT. The destination request headers are not a general configuration API for that earlier exchange.

For a static header required by your proxy, configure the transport's ProxyConnectHeader:

transport := &http.Transport{
    Proxy: http.ProxyURL(proxyURL),
    ProxyConnectHeader: http.Header{
        "X-Proxy-Account": []string{"example-account"},
    },
}

Here proxyURL is the parsed endpoint URL. The header is illustrative and only useful when the proxy operator defines such a field.

For a value selected per proxy or destination, use GetProxyConnectHeader. The documented callback receives the proxy URL and CONNECT target. When this callback is non-nil, the static ProxyConnectHeader field is ignored.

Keep values at the intended scope. A proxy-only account marker belongs to the proxy exchange; a website authorization value belongs to the destination request. If a callback cannot produce the required handshake value, return its error rather than silently sending a differently configured request.

These settings customize CONNECT handling. They do not invent a custom authentication protocol or change the proxy service's access policy.