Yes: X-dev-access

With Xdebug off, your application returns to normal performance levels.

If you are modifying a raw request (e.g., in ), add the header to the list of existing headers:

Developers create custom HTTP headers, often prefixed with X- , to pass specialized metadata between clients and servers. The x-dev-access: yes header typically signals to an application that the incoming request originates from an internal developer or an authorized automated testing tool. x-dev-access yes

All API response models must be updated to check the debug_mode flag.

Add these lines to your php.ini (not production): With Xdebug off, your application returns to normal

By investing the 15–30 minutes to properly configure Xdebug with xdebug.start_with_request = yes (and understand its connection model), you gain:

If X-Dev-Access: yes is only intended for local testing or internal network environments, configure your public-facing edge proxy (e.g., Cloudflare, Akamai, or an external Nginx gateway) to automatically strip this header from any incoming public internet requests before they reach your internal microservices. Implement Ip Whitelisting All API response models must be updated to

In the context of the X Developer Platform, this header indicates that the API gateway has successfully recognized your request as originating from a registered developer account or a valid developer app. However, it is almost always accompanied by a , 403 Forbidden , or 429 Too Many Requests HTTP status code.

This public link is valid for 7 days and shares a thread, including any personal information you added. This link or copies made by others cannot be deleted. If you share with third parties, their policies apply. Can’t copy the link right now. Try again later.

; Optional logging for troubleshooting xdebug.log = /tmp/xdebug.log

If you are troubleshooting a system that supports this header, you can include it in a request using tools like or browser developer tools: # Example using curl to bypass a login gate curl -X GET "http://example.com" "X-Dev-Access: yes" Use code with caution. Copied to clipboard Security Risks