HTTP Proxy Integration
Inject headers into HTTP requests from your VM
The HTTP Proxy integration serves as an HTTP(S) proxy that injects a header
into your request. This can be useful to interact with an API that requires
a bearer token.
For example, the following snippet creates, attaches, and uses the http proxy
integration to inject a header into a request.
```
exe.dev ▶ integrations add http-proxy --name mirror --target https://httpbin.org/ --header prettiest-of-them-all:me --attach vm:my-vm-name
Added integration mirror
Usage from a VM:
ssh my-vm-name.exe.xyz curl http://mirror.int.exe.xyz/
exe.dev ▶ ssh my-vm-name.exe.xyz curl -s http://mirror.int.exe.xyz/anything -Hfoo:bar
{
"args": {},
"data": "",
"files": {},
"form": {},
"headers": {
"Accept": "*/*",
"Accept-Encoding": "gzip",
"Foo": "bar",
"Host": "httpbin.org",
"Prettiest-Of-Them-All": "me",
"User-Agent": "curl/8.5.0",
"X-Amzn-Trace-Id": "Root=1-69b339a2-0032d20f5263c6dc17235289"
},
"json": null,
"method": "GET",
"origin": "64.34.88.25",
"url": "https://httpbin.org/anything"
}
```
The HTTP Proxy integration supports HTTP basic auth as well. When the
injected header carries a real credential (e.g. `--bearer`), remember it is
stored server-side and never visible from the VM — see
[Where secrets live](integrations#where-secrets-live).
## Path rewriting with `--strip-prefix`
Some APIs mount every endpoint under a version prefix (say `/api/v3`) that
you want to drop when proxying: requests to the integration should reach the
target with the prefix removed. `--strip-prefix` does exactly that — a
static path prefix stripped from the front of each matching request before
forwarding:
```
exe.dev ▶ integrations add http-proxy --name myapi --target https://api.example.com --bearer sk-... --strip-prefix /api/v3
```
With that configuration, from an attached VM:
- `http://myapi.int.exe.xyz/api/v3/users` → `https://api.example.com/users`
- `http://myapi.int.exe.xyz/api/v3` → `https://api.example.com/`
- `http://myapi.int.exe.xyz/healthz` → `https://api.example.com/healthz`
(a path outside the prefix passes through unchanged)
Matching is segment-aligned: `/api/v3x/other` does **not** match `/api/v3`
and is forwarded verbatim. The prefix must start with `/`, contains no
regex — only letters, digits, and `- _ . ~` in path segments — and composes
with `--header`/`--bearer`/basic-auth injection unchanged. Use
`integrations edit <name> --strip-prefix <new>` to change it, or
`--strip-prefix=""` to remove it. (The target URL itself still must not
carry a path; `--strip-prefix` is the sanctioned way to express a path
rewrite, in the request direction only.)
## Peer Integrations (VM-to-VM)
The `--peer` flag turns an HTTP proxy integration into a VM-to-VM proxy: the
`--target` is another VM you own, and exe.dev injects a generated API key so
the source VM can reach the target without managing tokens itself. Requests
arrive at the target with an `X-Exedev-Source-Vm` header naming the caller.
The platform signs an attestation alongside it and delivers the header only
when that attestation verifies, so it cannot be forged.
```
exe.dev ▶ integrations add http-proxy --name talk-to-bob --target https://bob.<your-domain>/ --peer --attach vm:alice
```
From `alice`, requests to `http://talk-to-bob.int.exe.xyz/` arrive at `bob`
with `X-Exedev-Source-Vm: alice`.
See the [VM-to-VM Integration](integrations-vm-to-vm) page for the full
story: the auth model, using the source-VM header safely, UI setup, and a
two-agent example.