Add how-to on headers (#4440)

and their configurability for configurability

docs/docs/cloud/how-tos/configurable_headers.md

@@ -0,0 +1,20 @@
+# Configurable Headers
+
+LangGraph allows runtime configuration to modify agent behavior and permissions dynamically. When using the [LangGraph Platform](../quick_start.md), you can pass this configuration in the request body (`config`) or specific request headers. This enables adjustments based on user identity or other request data (see the [configuration how-to](../../how-tos/configuration.ipynb) for more details on how to access within your graph).
+
+For privacy, control which headers are passed to the runtime configuration via the `http.configurable_headers` section in your `langgraph.json` file.
+
+Here's how to customize the included and excluded headers:
+
+```json
+{
+  "http": {
+    "configurable_headers": {
+      "include": ["x-user-id", "x-organization-id", "my-prefix-*"],
+      "exclude": ["authorization", "x-api-key"]
+    }
+  }
+}
+```
+
+The `include` and `exclude` lists accept exact header names or patterns using `*` to match any number of characters. For your security, no other regex patterns are supported.

docs/docs/cloud/reference/cli.md

@@ -49,7 +49,7 @@ The LangGraph CLI requires a JSON configuration file that follows this [schema](
     | <span style="white-space: nowrap;">`pip_config_file`</span>  | Path to `pip` config file.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
     | <span style="white-space: nowrap;">`dockerfile_lines`</span> | Array of additional lines to add to Dockerfile following the import from parent image.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
     | <span style="white-space: nowrap;">`checkpointer`</span>   | Configuration for the checkpointer. Contains a `ttl` field which is an object with the following keys: <ul><li>`strategy`: How to handle expired checkpoints (e.g., `"delete"`).</li><li>`sweep_interval_minutes`: How often to check for expired checkpoints (integer).</li><li>`default_ttl`: Default time-to-live for checkpoints in **minutes** (integer). Defines how long checkpoints are kept before the specified strategy is applied.</li></ul> |
-    | <span style="white-space: nowrap;">`http`</span>            | HTTP server configuration with the following fields: <ul><li>`app`: Path to custom Starlette/FastAPI app (e.g., `"./src/agent/webapp.py:app"`). See [custom routes guide](../../how-tos/http/custom_routes.md).</li><li>`disable_assistants`: Disable `/assistants` routes</li><li>`disable_threads`: Disable `/threads` routes</li><li>`disable_runs`: Disable `/runs` routes</li><li>`disable_store`: Disable `/store` routes</li><li>`disable_meta`: Disable `/ok`, `/info`, `/metrics`, and `/docs` routes</li><li>`cors`: CORS configuration with fields for `allow_origins`, `allow_methods`, `allow_headers`, etc.</li><li>`configurable_headers`: Define which request headers to exclude or include as a Run's configurable values.</li></ul> |
+    | <span style="white-space: nowrap;">`http`</span>            | HTTP server configuration with the following fields: <ul><li>`app`: Path to custom Starlette/FastAPI app (e.g., `"./src/agent/webapp.py:app"`). See [custom routes guide](../../how-tos/http/custom_routes.md).</li><li>`disable_assistants`: Disable `/assistants` routes</li><li>`disable_threads`: Disable `/threads` routes</li><li>`disable_runs`: Disable `/runs` routes</li><li>`disable_store`: Disable `/store` routes</li><li>`disable_meta`: Disable `/ok`, `/info`, `/metrics`, and `/docs` routes</li><li>`cors`: CORS configuration with fields for `allow_origins`, `allow_methods`, `allow_headers`, etc.</li><li>`configurable_headers`: Define which request headers to exclude or include as a run's configurable values.</li></ul> |
 
 === "JS"
 

docs/docs/how-tos/index.md

@@ -248,6 +248,7 @@ LangGraph Platform supports multiple types of runs besides streaming runs.
 - [How to run multiple agents in the same thread](../cloud/how-tos/same-thread.md)
 - [How to create cron jobs](../cloud/how-tos/cron_jobs.md)
 - [How to create stateless runs](../cloud/how-tos/stateless_runs.md)
+- [How to use headers as runtime configuration](../cloud/how-tos/configurable_headers.md)
 
 ### Streaming {#streaming_1}
 

docs/mkdocs.yml

@@ -216,6 +216,7 @@ nav:
                 - cloud/how-tos/same-thread.md
                 - cloud/how-tos/cron_jobs.md
                 - cloud/how-tos/stateless_runs.md
+                - cloud/how-tos/configurable_headers.md
             - Streaming:
                 - cloud/how-tos/stream_values.md
                 - cloud/how-tos/stream_updates.md