diff --git a/docs/docs/cloud/reference/cli.md b/docs/docs/cloud/reference/cli.md
index d0bce410f..b71a660ff 100644
--- a/docs/docs/cloud/reference/cli.md
+++ b/docs/docs/cloud/reference/cli.md
@@ -49,7 +49,7 @@ The LangGraph CLI requires a JSON configuration file that follows this [schema](
     | <span style="white-space: nowrap;">`pip_config_file`</span>  | Path to `pip` config file.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
     | <span style="white-space: nowrap;">`dockerfile_lines`</span> | Array of additional lines to add to Dockerfile following the import from parent image.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
     | <span style="white-space: nowrap;">`checkpointer`</span>   | Configuration for the checkpointer. Contains a `ttl` field which is an object with the following keys: <ul><li>`strategy`: How to handle expired checkpoints (e.g., `"delete"`).</li><li>`sweep_interval_minutes`: How often to check for expired checkpoints (integer).</li><li>`default_ttl`: Default time-to-live for checkpoints in **minutes** (integer). Defines how long checkpoints are kept before the specified strategy is applied.</li></ul> |
-    | <span style="white-space: nowrap;">`http`</span>            | HTTP server configuration with the following fields: <ul><li>`app`: Path to custom Starlette/FastAPI app (e.g., `"./src/agent/webapp.py:app"`). See [custom routes guide](../../how-tos/http/custom_routes.md).</li><li>`disable_assistants`: Disable `/assistants` routes</li><li>`disable_threads`: Disable `/threads` routes</li><li>`disable_runs`: Disable `/runs` routes</li><li>`disable_store`: Disable `/store` routes</li><li>`disable_meta`: Disable `/ok`, `/info`, `/metrics`, and `/docs` routes</li><li>`cors`: CORS configuration with fields for `allow_origins`, `allow_methods`, `allow_headers`, etc.</li></ul> |
+    | <span style="white-space: nowrap;">`http`</span>            | HTTP server configuration with the following fields: <ul><li>`app`: Path to custom Starlette/FastAPI app (e.g., `"./src/agent/webapp.py:app"`). See [custom routes guide](../../how-tos/http/custom_routes.md).</li><li>`disable_assistants`: Disable `/assistants` routes</li><li>`disable_threads`: Disable `/threads` routes</li><li>`disable_runs`: Disable `/runs` routes</li><li>`disable_store`: Disable `/store` routes</li><li>`disable_meta`: Disable `/ok`, `/info`, `/metrics`, and `/docs` routes</li><li>`cors`: CORS configuration with fields for `allow_origins`, `allow_methods`, `allow_headers`, etc.</li><li>`configurable_headers`: Define which request headers to exclude or include as a Run's configurable values.</li></ul> |
 
 === "JS"
 
diff --git a/libs/cli/generate_schema.py b/libs/cli/generate_schema.py
index 8a2e3718d..7a76ca5fa 100644
--- a/libs/cli/generate_schema.py
+++ b/libs/cli/generate_schema.py
@@ -17,6 +17,7 @@ from langgraph_cli.config import (
     AuthConfig,
     CheckpointerConfig,
     Config,
+    ConfigurableHeaderConfig,
     CorsConfig,
     HttpConfig,
     IndexConfig,
@@ -112,6 +113,7 @@ def add_descriptions_to_schema(schema, cls):
                 ThreadTTLConfig,
                 CheckpointerConfig,
                 TTLConfig,
+                ConfigurableHeaderConfig,
             ]:
                 if potential_cls.__name__ == def_name:
                     add_descriptions_to_schema(def_schema, potential_cls)
diff --git a/libs/cli/langgraph_cli/config.py b/libs/cli/langgraph_cli/config.py
index efbe55aa2..3ebe3fda4 100644
--- a/libs/cli/langgraph_cli/config.py
+++ b/libs/cli/langgraph_cli/config.py
@@ -273,6 +273,33 @@ class CorsConfig(TypedDict, total=False):
     """
 
 
+class ConfigurableHeaderConfig(TypedDict):
+    """Customize which headers to include as configurable values in your runs.
+
+    By default, omits x-api-key, x-tenant-id, and x-service-key.
+
+    Exclusions (if provided) take precedence.
+
+    Each value can be a raw string with an optional wildcard.
+    """
+
+    includes: Optional[list[str]]
+    """Headers to include (if not also matches against an 'exludes' pattern.
+
+    Examples:
+        - 'user-agent'
+        - 'x-configurable-*'
+    """
+    excludes: Optional[list[str]]
+    """Headers to exclude. Applied before the 'includes' checks.
+
+    Examples:
+        - 'x-api-key'
+        - '*key*'
+        - '*token*'
+    """
+
+
 class HttpConfig(TypedDict, total=False):
     """Configuration for the built-in HTTP server that powers your deployment's routes and endpoints."""
 
@@ -311,6 +338,11 @@ class HttpConfig(TypedDict, total=False):
     """Optional. Defines CORS restrictions. If omitted, no special rules are set and 
     cross-origin behavior depends on default server settings.
     """
+    configurable_headers: Optional[ConfigurableHeaderConfig]
+    """Optional. Defines how headers are treated for a run's configuration.
+
+    You can include or exclude headers as configurable values to condition your
+    agent's behavior or permissions on a request's headers."""
 
 
 class Config(TypedDict, total=False):
diff --git a/libs/cli/schemas/schema.json b/libs/cli/schemas/schema.json
index 845e5e0ab..1421e249e 100644
--- a/libs/cli/schemas/schema.json
+++ b/libs/cli/schemas/schema.json
@@ -399,6 +399,17 @@
           "type": "string",
           "description": "Optional. Import path to a custom Starlette/FastAPI application to mount.\n"
         },
+        "configurable_headers": {
+          "anyOf": [
+            {
+              "$ref": "#/$defs/ConfigurableHeaderConfig"
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "description": "Optional. Defines how headers are treated for a run's configuration.\n\nYou can include or exclude headers as configurable values to condition your\nagent's behavior or permissions on a request's headers."
+        },
         "cors": {
           "anyOf": [
             {
@@ -433,6 +444,45 @@
       },
       "required": []
     },
+    "ConfigurableHeaderConfig": {
+      "title": "ConfigurableHeaderConfig",
+      "description": "Customize which headers to include as configurable values in your runs.\n\nBy default, omits x-api-key, x-tenant-id, and x-service-key.\n\nExclusions (if provided) take precedence.\n\nEach value can be a raw string with an optional wildcard.",
+      "type": "object",
+      "properties": {
+        "excludes": {
+          "anyOf": [
+            {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "description": "Headers to exclude. Applied before the 'includes' checks.\n"
+        },
+        "includes": {
+          "anyOf": [
+            {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "description": "Headers to include (if not also matches against an 'exludes' pattern.\n"
+        }
+      },
+      "required": [
+        "excludes",
+        "includes"
+      ]
+    },
     "CorsConfig": {
       "title": "CorsConfig",
       "description": "Specifies Cross-Origin Resource Sharing (CORS) rules for your server.\n\nIf omitted, defaults are typically very restrictive (often no cross-origin requests).\nConfigure carefully if you want to allow usage from browsers hosted on other domains.",
diff --git a/libs/cli/schemas/schema.v0.json b/libs/cli/schemas/schema.v0.json
index 845e5e0ab..1421e249e 100644
--- a/libs/cli/schemas/schema.v0.json
+++ b/libs/cli/schemas/schema.v0.json
@@ -399,6 +399,17 @@
           "type": "string",
           "description": "Optional. Import path to a custom Starlette/FastAPI application to mount.\n"
         },
+        "configurable_headers": {
+          "anyOf": [
+            {
+              "$ref": "#/$defs/ConfigurableHeaderConfig"
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "description": "Optional. Defines how headers are treated for a run's configuration.\n\nYou can include or exclude headers as configurable values to condition your\nagent's behavior or permissions on a request's headers."
+        },
         "cors": {
           "anyOf": [
             {
@@ -433,6 +444,45 @@
       },
       "required": []
     },
+    "ConfigurableHeaderConfig": {
+      "title": "ConfigurableHeaderConfig",
+      "description": "Customize which headers to include as configurable values in your runs.\n\nBy default, omits x-api-key, x-tenant-id, and x-service-key.\n\nExclusions (if provided) take precedence.\n\nEach value can be a raw string with an optional wildcard.",
+      "type": "object",
+      "properties": {
+        "excludes": {
+          "anyOf": [
+            {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "description": "Headers to exclude. Applied before the 'includes' checks.\n"
+        },
+        "includes": {
+          "anyOf": [
+            {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "description": "Headers to include (if not also matches against an 'exludes' pattern.\n"
+        }
+      },
+      "required": [
+        "excludes",
+        "includes"
+      ]
+    },
     "CorsConfig": {
       "title": "CorsConfig",
       "description": "Specifies Cross-Origin Resource Sharing (CORS) rules for your server.\n\nIf omitted, defaults are typically very restrictive (often no cross-origin requests).\nConfigure carefully if you want to allow usage from browsers hosted on other domains.",