> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cocartapi.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> Security is the most important part of creating a headless store.

<Note>
  By default, CoCart cannot be found in WordPress REST API index under namespaces or routes.
</Note>

Don't be alarmed. This doesn't mean CoCart is not active on your site, we simply hide CoCart from any outsider trying to see if you are running it.

Most developers don't like the index of the REST API exposing these details so we made sure at least CoCart is not shown automatically.

## Authentication header

If you want to change the authorization header used for authenticating users with CoCart. Use filter `cocart_auth_header` to fetch the authorization value from it.

```php theme={"system"}
add_filter( 'cocart_auth_header', function( $auth_header ) {
    $custom_header = isset( $_SERVER['HTTP_X_MY_CUSTOM_AUTH'] ) 
    ? sanitize_text_field( wp_unslash( $_SERVER['HTTP_X_MY_CUSTOM_AUTH'] ) ) : '';

    return ! empty( $custom_header ) ? $custom_header : $auth_header;
}, 10, 1);
```