Create reusable Cloudflare Access, Bearer Token, or constrained Custom header sets, then map each set to enabled HTTPS sites. The toolbar popup can map an existing set to the active hostname. Exact host mappings replace wildcard defaults, and header sets never merge. Header values and local request rules remain in the browser profile to work after restarts: this is not a password manager or hardware-backed secret vault. Use dedicated, least-privilege credentials and keep scopes narrow. The extension has no telemetry, accounts, cloud sync, remote code, or developer-operated service.
