Managerr
All guides

Network & access

Reverse proxies & headers

Use a reverse proxy with API authentication, custom headers and a trusted HTTPS certificate.

The proxy address

Enter the final address that serves your application, including any base path. For example, a Sonarr installation behind a proxy might use https://media.example.com/sonarr. The proxy must forward the service’s API paths as well as its web interface.

Use the service’s API key in the API key field. Extra proxy authentication goes in Custom headers; it does not replace the service key.

Add custom headers

  1. Open the service editor and tap Add custom header.
  2. Enter the exact header name and value required by your proxy. Values are masked and stored in Keychain.
  3. Add a row for each additional header, then tap Test Service and Save.

An Authorization header can carry the Basic or Bearer value your proxy expects. Use HTTPS and follow your proxy’s configuration for the value. Managerr does not generate proxy tokens or run a browser login flow.

Header names must be unique, ignoring case. Values cannot contain line breaks or control characters. x-api-key, Host, Content-Length and Cookie are reserved and cannot be added.

Cloudflare Access

If your server uses Cloudflare Access, its administrator can configure a service token and a policy that accepts it. Add the token’s two headers: CF-Access-Client-Id and CF-Access-Client-Secret. Keep the service’s own API key in its separate field.

An interactive Access login page cannot authenticate Managerr’s API requests. The token must be allowed by the Access application’s policy. Follow Cloudflare’s service-token guide for creating the token and configuring the policy.

Redirects and certificates

Authenticated requests can follow a redirect only within the same origin: the same scheme, hostname and effective port. A redirect to a different host, port, or from HTTP to HTTPS is refused. Enter the final HTTPS address directly.

Managerr uses normal certificate validation. Fix an expired certificate, hostname mismatch or incomplete trust chain at the server or proxy. A browser exception does not make the certificate valid in Managerr.

When the web page works but the test fails

Check the reverse proxy’s access and error logs while running Test Service. A login page returned in place of API data, a stripped API-key header, a missing base path or an access-policy denial can all cause the test to fail even when Safari opens the website.

For status codes and a step-by-step check, see Troubleshooting.