feat: support per-request header override (#2631)

## Summary This PR introduces a `HeaderProvider` which is called for all remote HTTP calls to get the latest headers to inject. This is useful for features like adding the latest auth tokens where the header provider can auto-refresh tokens internally and each request always set the refreshed token. --------- Co-authored-by: Claude <noreply@anthropic.com>
2026-01-11 06:12:58 +00:00 · 2025-09-10 13:44:00 -07:00
parent 3c7419b392
commit 8da74dcb37
31 changed files with 2639 additions and 49 deletions
--- a/nodejs/test/remote.test.ts
+++ b/nodejs/test/remote.test.ts
@@ -7,9 +7,46 @@ import {
  ClientConfig,
  Connection,
  ConnectionOptions,
+  NativeJsHeaderProvider,
  TlsConfig,
  connect,
 } from "../lancedb";
+import {
+  HeaderProvider,
+  OAuthHeaderProvider,
+  StaticHeaderProvider,
+} from "../lancedb/header";
+
+// Test-only header providers
+class CustomProvider extends HeaderProvider {
+  getHeaders(): Record<string, string> {
+    return { "X-Custom": "custom-value" };
+  }
+}
+
+class ErrorProvider extends HeaderProvider {
+  private errorMessage: string;
+  public callCount: number = 0;
+
+  constructor(errorMessage: string = "Test error") {
+    super();
+    this.errorMessage = errorMessage;
+  }
+
+  getHeaders(): Record<string, string> {
+    this.callCount++;
+    throw new Error(this.errorMessage);
+  }
+}
+
+class ConcurrentProvider extends HeaderProvider {
+  private counter: number = 0;
+
+  getHeaders(): Record<string, string> {
+    this.counter++;
+    return { "X-Request-Id": String(this.counter) };
+  }
+}

 async function withMockDatabase(
  listener: RequestListener,
@@ -238,4 +275,347 @@ describe("remote connection", () => {
      );
    });
  });
+
+  describe("header providers", () => {
+    it("should work with StaticHeaderProvider", async () => {
+      const provider = new StaticHeaderProvider({
+        authorization: "Bearer test-token",
+        "X-Custom": "value",
+      });
+
+      const headers = provider.getHeaders();
+      expect(headers).toEqual({
+        authorization: "Bearer test-token",
+        "X-Custom": "value",
+      });
+
+      // Test that it returns a copy
+      headers["X-Modified"] = "modified";
+      const headers2 = provider.getHeaders();
+      expect(headers2).not.toHaveProperty("X-Modified");
+    });
+
+    it("should pass headers from StaticHeaderProvider to requests", async () => {
+      const provider = new StaticHeaderProvider({
+        "X-Custom-Auth": "secret-token",
+        "X-Request-Source": "test-suite",
+      });
+
+      await withMockDatabase(
+        (req, res) => {
+          expect(req.headers["x-custom-auth"]).toEqual("secret-token");
+          expect(req.headers["x-request-source"]).toEqual("test-suite");
+
+          const body = JSON.stringify({ tables: [] });
+          res.writeHead(200, { "Content-Type": "application/json" }).end(body);
+        },
+        async () => {
+          // Use actual header provider mechanism instead of extraHeaders
+          const conn = await connect(
+            "db://dev",
+            {
+              apiKey: "fake",
+              hostOverride: "http://localhost:8000",
+            },
+            undefined, // session
+            provider, // headerProvider
+          );
+
+          const tableNames = await conn.tableNames();
+          expect(tableNames).toEqual([]);
+        },
+      );
+    });
+
+    it("should work with CustomProvider", () => {
+      const provider = new CustomProvider();
+      const headers = provider.getHeaders();
+      expect(headers).toEqual({ "X-Custom": "custom-value" });
+    });
+
+    it("should handle ErrorProvider errors", () => {
+      const provider = new ErrorProvider("Authentication failed");
+
+      expect(() => provider.getHeaders()).toThrow("Authentication failed");
+      expect(provider.callCount).toBe(1);
+
+      // Test that error is thrown each time
+      expect(() => provider.getHeaders()).toThrow("Authentication failed");
+      expect(provider.callCount).toBe(2);
+    });
+
+    it("should work with ConcurrentProvider", () => {
+      const provider = new ConcurrentProvider();
+
+      const headers1 = provider.getHeaders();
+      const headers2 = provider.getHeaders();
+      const headers3 = provider.getHeaders();
+
+      expect(headers1).toEqual({ "X-Request-Id": "1" });
+      expect(headers2).toEqual({ "X-Request-Id": "2" });
+      expect(headers3).toEqual({ "X-Request-Id": "3" });
+    });
+
+    describe("OAuthHeaderProvider", () => {
+      it("should initialize correctly", () => {
+        const fetcher = () => ({
+          accessToken: "token123",
+          expiresIn: 3600,
+        });
+
+        const provider = new OAuthHeaderProvider(fetcher);
+        expect(provider).toBeInstanceOf(HeaderProvider);
+      });
+
+      it("should fetch token on first use", async () => {
+        let callCount = 0;
+        const fetcher = () => {
+          callCount++;
+          return {
+            accessToken: "token123",
+            expiresIn: 3600,
+          };
+        };
+
+        const provider = new OAuthHeaderProvider(fetcher);
+
+        // Need to manually refresh first due to sync limitation
+        await provider.refreshToken();
+
+        const headers = provider.getHeaders();
+        expect(headers).toEqual({ authorization: "Bearer token123" });
+        expect(callCount).toBe(1);
+
+        // Second call should not fetch again
+        const headers2 = provider.getHeaders();
+        expect(headers2).toEqual({ authorization: "Bearer token123" });
+        expect(callCount).toBe(1);
+      });
+
+      it("should handle tokens without expiry", async () => {
+        const fetcher = () => ({
+          accessToken: "permanent_token",
+        });
+
+        const provider = new OAuthHeaderProvider(fetcher);
+        await provider.refreshToken();
+
+        const headers = provider.getHeaders();
+        expect(headers).toEqual({ authorization: "Bearer permanent_token" });
+      });
+
+      it("should throw error when access_token is missing", async () => {
+        const fetcher = () =>
+          ({
+            expiresIn: 3600,
+          }) as { accessToken?: string; expiresIn?: number };
+
+        const provider = new OAuthHeaderProvider(
+          fetcher as () => {
+            accessToken: string;
+            expiresIn?: number;
+          },
+        );
+
+        await expect(provider.refreshToken()).rejects.toThrow(
+          "Token fetcher did not return 'accessToken'",
+        );
+      });
+
+      it("should handle async token fetchers", async () => {
+        const fetcher = async () => {
+          // Simulate async operation
+          await new Promise((resolve) => setTimeout(resolve, 10));
+          return {
+            accessToken: "async_token",
+            expiresIn: 3600,
+          };
+        };
+
+        const provider = new OAuthHeaderProvider(fetcher);
+        await provider.refreshToken();
+
+        const headers = provider.getHeaders();
+        expect(headers).toEqual({ authorization: "Bearer async_token" });
+      });
+    });
+
+    it("should merge header provider headers with extra headers", async () => {
+      const provider = new StaticHeaderProvider({
+        "X-From-Provider": "provider-value",
+      });
+
+      await withMockDatabase(
+        (req, res) => {
+          expect(req.headers["x-from-provider"]).toEqual("provider-value");
+          expect(req.headers["x-extra-header"]).toEqual("extra-value");
+
+          const body = JSON.stringify({ tables: [] });
+          res.writeHead(200, { "Content-Type": "application/json" }).end(body);
+        },
+        async () => {
+          // Use header provider with additional extraHeaders
+          const conn = await connect(
+            "db://dev",
+            {
+              apiKey: "fake",
+              hostOverride: "http://localhost:8000",
+              clientConfig: {
+                extraHeaders: {
+                  "X-Extra-Header": "extra-value",
+                },
+              },
+            },
+            undefined, // session
+            provider, // headerProvider
+          );
+
+          const tableNames = await conn.tableNames();
+          expect(tableNames).toEqual([]);
+        },
+      );
+    });
+  });
+
+  describe("header provider integration", () => {
+    it("should work with TypeScript StaticHeaderProvider", async () => {
+      let requestCount = 0;
+
+      await withMockDatabase(
+        (req, res) => {
+          requestCount++;
+
+          // Check headers are present on each request
+          expect(req.headers["authorization"]).toEqual("Bearer test-token-123");
+          expect(req.headers["x-custom"]).toEqual("custom-value");
+
+          // Return different responses based on the endpoint
+          if (req.url === "/v1/table/test_table/describe/") {
+            const body = JSON.stringify({
+              name: "test_table",
+              schema: { fields: [] },
+            });
+            res
+              .writeHead(200, { "Content-Type": "application/json" })
+              .end(body);
+          } else {
+            const body = JSON.stringify({ tables: ["test_table"] });
+            res
+              .writeHead(200, { "Content-Type": "application/json" })
+              .end(body);
+          }
+        },
+        async () => {
+          // Create provider with static headers
+          const provider = new StaticHeaderProvider({
+            authorization: "Bearer test-token-123",
+            "X-Custom": "custom-value",
+          });
+
+          // Connect with the provider
+          const conn = await connect(
+            "db://dev",
+            {
+              apiKey: "fake",
+              hostOverride: "http://localhost:8000",
+            },
+            undefined, // session
+            provider, // headerProvider
+          );
+
+          // Make multiple requests to verify headers are sent each time
+          const tables1 = await conn.tableNames();
+          expect(tables1).toEqual(["test_table"]);
+
+          const tables2 = await conn.tableNames();
+          expect(tables2).toEqual(["test_table"]);
+
+          // Verify headers were sent with each request
+          expect(requestCount).toBeGreaterThanOrEqual(2);
+        },
+      );
+    });
+
+    it("should work with JavaScript function provider", async () => {
+      let requestId = 0;
+
+      await withMockDatabase(
+        (req, res) => {
+          // Check dynamic header is present
+          expect(req.headers["x-request-id"]).toBeDefined();
+          expect(req.headers["x-request-id"]).toMatch(/^req-\d+$/);
+
+          const body = JSON.stringify({ tables: [] });
+          res.writeHead(200, { "Content-Type": "application/json" }).end(body);
+        },
+        async () => {
+          // Create a JavaScript function that returns dynamic headers
+          const getHeaders = async () => {
+            requestId++;
+            return {
+              "X-Request-Id": `req-${requestId}`,
+              "X-Timestamp": new Date().toISOString(),
+            };
+          };
+
+          // Connect with the function directly
+          const conn = await connect(
+            "db://dev",
+            {
+              apiKey: "fake",
+              hostOverride: "http://localhost:8000",
+            },
+            undefined, // session
+            getHeaders, // headerProvider
+          );
+
+          // Make requests - each should have different headers
+          const tables = await conn.tableNames();
+          expect(tables).toEqual([]);
+        },
+      );
+    });
+
+    it("should support OAuth-like token refresh pattern", async () => {
+      let tokenVersion = 0;
+
+      await withMockDatabase(
+        (req, res) => {
+          // Verify authorization header
+          const authHeader = req.headers["authorization"];
+          expect(authHeader).toBeDefined();
+          expect(authHeader).toMatch(/^Bearer token-v\d+$/);
+
+          const body = JSON.stringify({ tables: [] });
+          res.writeHead(200, { "Content-Type": "application/json" }).end(body);
+        },
+        async () => {
+          // Simulate OAuth token fetcher
+          const fetchToken = async () => {
+            tokenVersion++;
+            return {
+              authorization: `Bearer token-v${tokenVersion}`,
+            };
+          };
+
+          // Connect with the function directly
+          const conn = await connect(
+            "db://dev",
+            {
+              apiKey: "fake",
+              hostOverride: "http://localhost:8000",
+            },
+            undefined, // session
+            fetchToken, // headerProvider
+          );
+
+          // Each request will fetch a new token
+          await conn.tableNames();
+
+          // Token should be different on next request
+          await conn.tableNames();
+        },
+      );
+    });
+  });
 });
--- a/nodejs/lancedb/header.ts
+++ b/nodejs/lancedb/header.ts
@@ -0,0 +1,253 @@
+// SPDX-License-Identifier: Apache-2.0
+// SPDX-FileCopyrightText: Copyright The LanceDB Authors
+
+/**
+ * Header providers for LanceDB remote connections.
+ *
+ * This module provides a flexible header management framework for LanceDB remote
+ * connections, allowing users to implement custom header strategies for
+ * authentication, request tracking, custom metadata, or any other header-based
+ * requirements.
+ *
+ * @module header
+ */
+
+/**
+ * Abstract base class for providing custom headers for each request.
+ *
+ * Users can implement this interface to provide dynamic headers for various purposes
+ * such as authentication (OAuth tokens, API keys), request tracking (correlation IDs),
+ * custom metadata, or any other header-based requirements. The provider is called
+ * before each request to ensure fresh header values are always used.
+ *
+ * @example
+ * Simple JWT token provider:
+ * ```typescript
+ * class JWTProvider extends HeaderProvider {
+ *   constructor(private token: string) {
+ *     super();
+ *   }
+ *
+ *   getHeaders(): Record<string, string> {
+ *     return { authorization: `Bearer ${this.token}` };
+ *   }
+ * }
+ * ```
+ *
+ * @example
+ * Provider with request tracking:
+ * ```typescript
+ * class RequestTrackingProvider extends HeaderProvider {
+ *   constructor(private sessionId: string) {
+ *     super();
+ *   }
+ *
+ *   getHeaders(): Record<string, string> {
+ *     return {
+ *       "X-Session-Id": this.sessionId,
+ *       "X-Request-Id": `req-${Date.now()}`
+ *     };
+ *   }
+ * }
+ * ```
+ */
+export abstract class HeaderProvider {
+  /**
+   * Get the latest headers to be added to requests.
+   *
+   * This method is called before each request to the remote LanceDB server.
+   * Implementations should return headers that will be merged with existing headers.
+   *
+   * @returns Dictionary of header names to values to add to the request.
+   * @throws If unable to fetch headers, the exception will be propagated and the request will fail.
+   */
+  abstract getHeaders(): Record<string, string>;
+}
+
+/**
+ * Example implementation: A simple header provider that returns static headers.
+ *
+ * This is an example implementation showing how to create a HeaderProvider
+ * for cases where headers don't change during the session.
+ *
+ * @example
+ * ```typescript
+ * const provider = new StaticHeaderProvider({
+ *   authorization: "Bearer my-token",
+ *   "X-Custom-Header": "custom-value"
+ * });
+ * const headers = provider.getHeaders();
+ * // Returns: {authorization: 'Bearer my-token', 'X-Custom-Header': 'custom-value'}
+ * ```
+ */
+export class StaticHeaderProvider extends HeaderProvider {
+  private _headers: Record<string, string>;
+
+  /**
+   * Initialize with static headers.
+   * @param headers - Headers to return for every request.
+   */
+  constructor(headers: Record<string, string>) {
+    super();
+    this._headers = { ...headers };
+  }
+
+  /**
+   * Return the static headers.
+   * @returns Copy of the static headers.
+   */
+  getHeaders(): Record<string, string> {
+    return { ...this._headers };
+  }
+}
+
+/**
+ * Token response from OAuth provider.
+ * @public
+ */
+export interface TokenResponse {
+  accessToken: string;
+  expiresIn?: number;
+}
+
+/**
+ * Example implementation: OAuth token provider with automatic refresh.
+ *
+ * This is an example implementation showing how to manage OAuth tokens
+ * with automatic refresh when they expire.
+ *
+ * @example
+ * ```typescript
+ * async function fetchToken(): Promise<TokenResponse> {
+ *   const response = await fetch("https://oauth.example.com/token", {
+ *     method: "POST",
+ *     body: JSON.stringify({
+ *       grant_type: "client_credentials",
+ *       client_id: "your-client-id",
+ *       client_secret: "your-client-secret"
+ *     }),
+ *     headers: { "Content-Type": "application/json" }
+ *   });
+ *   const data = await response.json();
+ *   return {
+ *     accessToken: data.access_token,
+ *     expiresIn: data.expires_in
+ *   };
+ * }
+ *
+ * const provider = new OAuthHeaderProvider(fetchToken);
+ * const headers = provider.getHeaders();
+ * // Returns: {"authorization": "Bearer <your-token>"}
+ * ```
+ */
+export class OAuthHeaderProvider extends HeaderProvider {
+  private _tokenFetcher: () => Promise<TokenResponse> | TokenResponse;
+  private _refreshBufferSeconds: number;
+  private _currentToken: string | null = null;
+  private _tokenExpiresAt: number | null = null;
+  private _refreshPromise: Promise<void> | null = null;
+
+  /**
+   * Initialize the OAuth provider.
+   * @param tokenFetcher - Function to fetch new tokens. Should return object with 'accessToken' and optionally 'expiresIn'.
+   * @param refreshBufferSeconds - Seconds before expiry to refresh token. Default 300 (5 minutes).
+   */
+  constructor(
+    tokenFetcher: () => Promise<TokenResponse> | TokenResponse,
+    refreshBufferSeconds: number = 300,
+  ) {
+    super();
+    this._tokenFetcher = tokenFetcher;
+    this._refreshBufferSeconds = refreshBufferSeconds;
+  }
+
+  /**
+   * Check if token needs refresh.
+   */
+  private _needsRefresh(): boolean {
+    if (this._currentToken === null) {
+      return true;
+    }
+
+    if (this._tokenExpiresAt === null) {
+      // No expiration info, assume token is valid
+      return false;
+    }
+
+    // Refresh if we're within the buffer time of expiration
+    const now = Date.now() / 1000;
+    return now >= this._tokenExpiresAt - this._refreshBufferSeconds;
+  }
+
+  /**
+   * Refresh the token if it's expired or close to expiring.
+   */
+  private async _refreshTokenIfNeeded(): Promise<void> {
+    if (!this._needsRefresh()) {
+      return;
+    }
+
+    // If refresh is already in progress, wait for it
+    if (this._refreshPromise) {
+      await this._refreshPromise;
+      return;
+    }
+
+    // Start refresh
+    this._refreshPromise = (async () => {
+      try {
+        const tokenData = await this._tokenFetcher();
+
+        this._currentToken = tokenData.accessToken;
+        if (!this._currentToken) {
+          throw new Error("Token fetcher did not return 'accessToken'");
+        }
+
+        // Set expiration if provided
+        if (tokenData.expiresIn) {
+          this._tokenExpiresAt = Date.now() / 1000 + tokenData.expiresIn;
+        } else {
+          // Token doesn't expire or expiration unknown
+          this._tokenExpiresAt = null;
+        }
+      } finally {
+        this._refreshPromise = null;
+      }
+    })();
+
+    await this._refreshPromise;
+  }
+
+  /**
+   * Get OAuth headers, refreshing token if needed.
+   * Note: This is synchronous for now as the Rust implementation expects sync.
+   * In a real implementation, this would need to handle async properly.
+   * @returns Headers with Bearer token authorization.
+   * @throws If unable to fetch or refresh token.
+   */
+  getHeaders(): Record<string, string> {
+    // For simplicity in this example, we assume the token is already fetched
+    // In a real implementation, this would need to handle the async nature properly
+    if (!this._currentToken && !this._refreshPromise) {
+      // Synchronously trigger refresh - this is a limitation of the current implementation
+      throw new Error(
+        "Token not initialized. Call refreshToken() first or use async initialization.",
+      );
+    }
+
+    if (!this._currentToken) {
+      throw new Error("Failed to obtain OAuth token");
+    }
+
+    return { authorization: `Bearer ${this._currentToken}` };
+  }
+
+  /**
+   * Manually refresh the token.
+   * Call this before using getHeaders() to ensure token is available.
+   */
+  async refreshToken(): Promise<void> {
+    this._currentToken = null; // Force refresh
+    await this._refreshTokenIfNeeded();
+  }
+}
--- a/nodejs/lancedb/index.ts
+++ b/nodejs/lancedb/index.ts
@@ -10,9 +10,15 @@ import {
 import {
  ConnectionOptions,
  Connection as LanceDbConnection,
+  JsHeaderProvider as NativeJsHeaderProvider,
  Session,
 } from "./native.js";

+import { HeaderProvider } from "./header";
+
+// Re-export native header provider for use with connectWithHeaderProvider
+export { JsHeaderProvider as NativeJsHeaderProvider } from "./native.js";
+
 export {
  AddColumnsSql,
  ConnectionOptions,
@@ -94,6 +100,13 @@ export {
  ColumnAlteration,
 } from "./table";

+export {
+  HeaderProvider,
+  StaticHeaderProvider,
+  OAuthHeaderProvider,
+  TokenResponse,
+} from "./header";
+
 export { MergeInsertBuilder, WriteExecutionOptions } from "./merge";

 export * as embedding from "./embedding";
@@ -132,11 +145,27 @@ export { IntoSql, packBits } from "./util";
 *   {storageOptions: {timeout: "60s"}
 * });
 * ```
+ * @example
+ * Using with a header provider for per-request authentication:
+ * ```ts
+ * const provider = new StaticHeaderProvider({
+ *   "X-API-Key": "my-key"
+ * });
+ * const conn = await connectWithHeaderProvider(
+ *   "db://host:port",
+ *   options,
+ *   provider
+ * );
+ * ```
 */
 export async function connect(
  uri: string,
  options?: Partial<ConnectionOptions>,
  session?: Session,
+  headerProvider?:
+    | HeaderProvider
+    | (() => Record<string, string>)
+    | (() => Promise<Record<string, string>>),
 ): Promise<Connection>;
 /**
 * Connect to a LanceDB instance at the given URI.
@@ -170,18 +199,58 @@ export async function connect(
 ): Promise<Connection>;
 export async function connect(
  uriOrOptions: string | (Partial<ConnectionOptions> & { uri: string }),
-  options?: Partial<ConnectionOptions>,
+  optionsOrSession?: Partial<ConnectionOptions> | Session,
+  sessionOrHeaderProvider?:
+    | Session
+    | HeaderProvider
+    | (() => Record<string, string>)
+    | (() => Promise<Record<string, string>>),
+  headerProvider?:
+    | HeaderProvider
+    | (() => Record<string, string>)
+    | (() => Promise<Record<string, string>>),
 ): Promise<Connection> {
  let uri: string | undefined;
  let finalOptions: Partial<ConnectionOptions> = {};
+  let finalHeaderProvider:
+    | HeaderProvider
+    | (() => Record<string, string>)
+    | (() => Promise<Record<string, string>>)
+    | undefined;

  if (typeof uriOrOptions !== "string") {
+    // First overload: connect(options)
    const { uri: uri_, ...opts } = uriOrOptions;
    uri = uri_;
    finalOptions = opts;
  } else {
+    // Second overload: connect(uri, options?, session?, headerProvider?)
    uri = uriOrOptions;
-    finalOptions = options || {};
+
+    // Handle optionsOrSession parameter
+    if (optionsOrSession && "inner" in optionsOrSession) {
+      // Second param is session, so no options provided
+      finalOptions = {};
+    } else {
+      // Second param is options
+      finalOptions = (optionsOrSession as Partial<ConnectionOptions>) || {};
+    }
+
+    // Handle sessionOrHeaderProvider parameter
+    if (
+      sessionOrHeaderProvider &&
+      (typeof sessionOrHeaderProvider === "function" ||
+        "getHeaders" in sessionOrHeaderProvider)
+    ) {
+      // Third param is header provider
+      finalHeaderProvider = sessionOrHeaderProvider as
+        | HeaderProvider
+        | (() => Record<string, string>)
+        | (() => Promise<Record<string, string>>);
+    } else {
+      // Third param is session, header provider is fourth param
+      finalHeaderProvider = headerProvider;
+    }
  }

  if (!uri) {
@@ -192,6 +261,26 @@ export async function connect(
  (<ConnectionOptions>finalOptions).storageOptions = cleanseStorageOptions(
    (<ConnectionOptions>finalOptions).storageOptions,
  );
-  const nativeConn = await LanceDbConnection.new(uri, finalOptions);
+
+  // Create native header provider if one was provided
+  let nativeProvider: NativeJsHeaderProvider | undefined;
+  if (finalHeaderProvider) {
+    if (typeof finalHeaderProvider === "function") {
+      nativeProvider = new NativeJsHeaderProvider(finalHeaderProvider);
+    } else if (
+      finalHeaderProvider &&
+      typeof finalHeaderProvider.getHeaders === "function"
+    ) {
+      nativeProvider = new NativeJsHeaderProvider(async () =>
+        finalHeaderProvider.getHeaders(),
+      );
+    }
+  }
+
+  const nativeConn = await LanceDbConnection.new(
+    uri,
+    finalOptions,
+    nativeProvider,
+  );
  return new LocalConnection(nativeConn);
 }
--- a/nodejs/package-lock.json
+++ b/nodejs/package-lock.json
@@ -5549,10 +5549,11 @@
      "dev": true
    },
    "node_modules/brace-expansion": {
-      "version": "1.1.11",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.11.tgz",
-      "integrity": "sha512-iCuPHDFgrHX7H2vEI/5xpz07zSHB00TpugqhmYtVmMO6518mCuRMoOYFldEBl0g187ufozdaHgWKcYFb61qGiA==",
+      "version": "1.1.12",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz",
+      "integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==",
      "dev": true,
+      "license": "MIT",
      "dependencies": {
        "balanced-match": "^1.0.0",
        "concat-map": "0.0.1"
@@ -5629,6 +5630,20 @@
      "integrity": "sha512-E+XQCRwSbaaiChtv6k6Dwgc+bx+Bs6vuKJHHl5kox/BaKbhiXzqQOwK4cO22yElGp2OCmjwVhT3HmxgyPGnJfQ==",
      "dev": true
    },
+    "node_modules/call-bind-apply-helpers": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/call-bind-apply-helpers/-/call-bind-apply-helpers-1.0.2.tgz",
+      "integrity": "sha512-Sp1ablJ0ivDkSzjcaJdxEunN5/XvksFJ2sMBFfq6x0ryhQV/2b/KwFe21cMpmHtPOSij8K99/wSfoEuTObmuMQ==",
+      "devOptional": true,
+      "license": "MIT",
+      "dependencies": {
+        "es-errors": "^1.3.0",
+        "function-bind": "^1.1.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
    "node_modules/camelcase": {
      "version": "5.3.1",
      "resolved": "https://registry.npmjs.org/camelcase/-/camelcase-5.3.1.tgz",
@@ -6032,6 +6047,21 @@
        "node": ">=6.0.0"
      }
    },
+    "node_modules/dunder-proto": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/dunder-proto/-/dunder-proto-1.0.1.tgz",
+      "integrity": "sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==",
+      "devOptional": true,
+      "license": "MIT",
+      "dependencies": {
+        "call-bind-apply-helpers": "^1.0.1",
+        "es-errors": "^1.3.0",
+        "gopd": "^1.2.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
    "node_modules/eastasianwidth": {
      "version": "0.2.0",
      "resolved": "https://registry.npmjs.org/eastasianwidth/-/eastasianwidth-0.2.0.tgz",
@@ -6071,6 +6101,55 @@
        "is-arrayish": "^0.2.1"
      }
    },
+    "node_modules/es-define-property": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/es-define-property/-/es-define-property-1.0.1.tgz",
+      "integrity": "sha512-e3nRfgfUZ4rNGL232gUgX06QNyyez04KdjFrF+LTRoOXmrOgFKDg4BCdsjW8EnT69eqdYGmRpJwiPVYNrCaW3g==",
+      "devOptional": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/es-errors": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/es-errors/-/es-errors-1.3.0.tgz",
+      "integrity": "sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==",
+      "devOptional": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/es-object-atoms": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.1.tgz",
+      "integrity": "sha512-FGgH2h8zKNim9ljj7dankFPcICIK9Cp5bm+c2gQSYePhpaG5+esrLODihIorn+Pe6FGJzWhXQotPv73jTaldXA==",
+      "devOptional": true,
+      "license": "MIT",
+      "dependencies": {
+        "es-errors": "^1.3.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/es-set-tostringtag": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/es-set-tostringtag/-/es-set-tostringtag-2.1.0.tgz",
+      "integrity": "sha512-j6vWzfrGVfyXxge+O0x5sh6cvxAog0a/4Rdd2K36zCMV5eJ+/+tOAngRO8cODMNWbVRdVlmGZQL2YS3yR8bIUA==",
+      "devOptional": true,
+      "license": "MIT",
+      "dependencies": {
+        "es-errors": "^1.3.0",
+        "get-intrinsic": "^1.2.6",
+        "has-tostringtag": "^1.0.2",
+        "hasown": "^2.0.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
    "node_modules/escalade": {
      "version": "3.1.1",
      "resolved": "https://registry.npmjs.org/escalade/-/escalade-3.1.1.tgz",
@@ -6510,13 +6589,16 @@
      }
    },
    "node_modules/form-data": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.0.tgz",
-      "integrity": "sha512-ETEklSGi5t0QMZuiXoA/Q6vcnxcLQP5vdugSpuAyi6SVGi2clPPp+xgEhuMaHC+zGgn31Kd235W35f7Hykkaww==",
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.4.tgz",
+      "integrity": "sha512-KrGhL9Q4zjj0kiUt5OO4Mr/A/jlI2jDYs5eHBpYHPcBEVSiipAvn2Ko2HnPe20rmcuuvMHNdZFp+4IlGTMF0Ow==",
      "devOptional": true,
+      "license": "MIT",
      "dependencies": {
        "asynckit": "^0.4.0",
        "combined-stream": "^1.0.8",
+        "es-set-tostringtag": "^2.1.0",
+        "hasown": "^2.0.2",
        "mime-types": "^2.1.12"
      },
      "engines": {
@@ -6575,7 +6657,7 @@
      "version": "1.1.2",
      "resolved": "https://registry.npmjs.org/function-bind/-/function-bind-1.1.2.tgz",
      "integrity": "sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA==",
-      "dev": true,
+      "devOptional": true,
      "funding": {
        "url": "https://github.com/sponsors/ljharb"
      }
@@ -6598,6 +6680,31 @@
        "node": "6.* || 8.* || >= 10.*"
      }
    },
+    "node_modules/get-intrinsic": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/get-intrinsic/-/get-intrinsic-1.3.0.tgz",
+      "integrity": "sha512-9fSjSaos/fRIVIp+xSJlE6lfwhES7LNtKaCBIamHsjr2na1BiABJPo0mOjjz8GJDURarmCPGqaiVg5mfjb98CQ==",
+      "devOptional": true,
+      "license": "MIT",
+      "dependencies": {
+        "call-bind-apply-helpers": "^1.0.2",
+        "es-define-property": "^1.0.1",
+        "es-errors": "^1.3.0",
+        "es-object-atoms": "^1.1.1",
+        "function-bind": "^1.1.2",
+        "get-proto": "^1.0.1",
+        "gopd": "^1.2.0",
+        "has-symbols": "^1.1.0",
+        "hasown": "^2.0.2",
+        "math-intrinsics": "^1.1.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
    "node_modules/get-package-type": {
      "version": "0.1.0",
      "resolved": "https://registry.npmjs.org/get-package-type/-/get-package-type-0.1.0.tgz",
@@ -6607,6 +6714,20 @@
        "node": ">=8.0.0"
      }
    },
+    "node_modules/get-proto": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/get-proto/-/get-proto-1.0.1.tgz",
+      "integrity": "sha512-sTSfBjoXBp89JvIKIefqw7U2CCebsc74kiY6awiGogKtoSGbgjYE/G/+l9sF3MWFPNc9IcoOC4ODfKHfxFmp0g==",
+      "devOptional": true,
+      "license": "MIT",
+      "dependencies": {
+        "dunder-proto": "^1.0.1",
+        "es-object-atoms": "^1.0.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
    "node_modules/get-stream": {
      "version": "6.0.1",
      "resolved": "https://registry.npmjs.org/get-stream/-/get-stream-6.0.1.tgz",
@@ -6698,6 +6819,19 @@
        "url": "https://github.com/sponsors/sindresorhus"
      }
    },
+    "node_modules/gopd": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/gopd/-/gopd-1.2.0.tgz",
+      "integrity": "sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg==",
+      "devOptional": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
    "node_modules/graceful-fs": {
      "version": "4.2.11",
      "resolved": "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.2.11.tgz",
@@ -6724,11 +6858,41 @@
        "node": ">=8"
      }
    },
+    "node_modules/has-symbols": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/has-symbols/-/has-symbols-1.1.0.tgz",
+      "integrity": "sha512-1cDNdwJ2Jaohmb3sg4OmKaMBwuC48sYni5HUw2DvsC8LjGTLK9h+eb1X6RyuOHe4hT0ULCW68iomhjUoKUqlPQ==",
+      "devOptional": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/has-tostringtag": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/has-tostringtag/-/has-tostringtag-1.0.2.tgz",
+      "integrity": "sha512-NqADB8VjPFLM2V0VvHUewwwsw0ZWBaIdgo+ieHtK3hasLz4qeCRjYcqfB6AQrBggRKppKF8L52/VqdVsO47Dlw==",
+      "devOptional": true,
+      "license": "MIT",
+      "dependencies": {
+        "has-symbols": "^1.0.3"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
    "node_modules/hasown": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.0.tgz",
-      "integrity": "sha512-vUptKVTpIJhcczKBbgnS+RtcuYMB8+oNzPK2/Hp3hanz8JmpATdmmgLgSaadVREkDm+e2giHwY3ZRkyjSIDDFA==",
-      "dev": true,
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.2.tgz",
+      "integrity": "sha512-0hJU9SCPvmMzIBdZFqNPXWa6dqh7WdH0cII9y+CyS8rG3nL48Bclra9HmKhVVUHyPWNH5Y7xDwAB7bfgSjkUMQ==",
+      "devOptional": true,
+      "license": "MIT",
      "dependencies": {
        "function-bind": "^1.1.2"
      },
@@ -7943,6 +8107,16 @@
      "integrity": "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==",
      "dev": true
    },
+    "node_modules/math-intrinsics": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/math-intrinsics/-/math-intrinsics-1.1.0.tgz",
+      "integrity": "sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g==",
+      "devOptional": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
    "node_modules/md5": {
      "version": "2.3.0",
      "resolved": "https://registry.npmjs.org/md5/-/md5-2.3.0.tgz",
@@ -8053,9 +8227,10 @@
      }
    },
    "node_modules/minizlib/node_modules/brace-expansion": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.1.tgz",
-      "integrity": "sha512-XnAIvQ8eM+kC6aULx6wuQiwVsnzsi9d3WxzV3FpWTGA19F621kwdbsAcFKXgKUHZWsy+mY6iL1sHTxWEFCytDA==",
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.2.tgz",
+      "integrity": "sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==",
+      "license": "MIT",
      "optional": true,
      "dependencies": {
        "balanced-match": "^1.0.0"
@@ -9201,10 +9376,11 @@
      "dev": true
    },
    "node_modules/tmp": {
-      "version": "0.2.3",
-      "resolved": "https://registry.npmjs.org/tmp/-/tmp-0.2.3.tgz",
-      "integrity": "sha512-nZD7m9iCPC5g0pYmcaxogYKggSfLsdxl8of3Q/oIbqCqLLIO9IAF0GWjX1z9NZRHPiXv8Wex4yDCaZsgEw0Y8w==",
+      "version": "0.2.5",
+      "resolved": "https://registry.npmjs.org/tmp/-/tmp-0.2.5.tgz",
+      "integrity": "sha512-voyz6MApa1rQGUxT3E+BK7/ROe8itEx7vD8/HEvt4xwXucvQ5G5oeEiHkmHZJuBO21RpOf+YYm9MOivj709jow==",
      "dev": true,
+      "license": "MIT",
      "engines": {
        "node": ">=14.14"
      }
@@ -9349,10 +9525,11 @@
      }
    },
    "node_modules/typedoc/node_modules/brace-expansion": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.1.tgz",
-      "integrity": "sha512-XnAIvQ8eM+kC6aULx6wuQiwVsnzsi9d3WxzV3FpWTGA19F621kwdbsAcFKXgKUHZWsy+mY6iL1sHTxWEFCytDA==",
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.2.tgz",
+      "integrity": "sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==",
      "dev": true,
+      "license": "MIT",
      "dependencies": {
        "balanced-match": "^1.0.0"
      }
@@ -9602,10 +9779,11 @@
      }
    },
    "node_modules/typescript-eslint/node_modules/brace-expansion": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.1.tgz",
-      "integrity": "sha512-XnAIvQ8eM+kC6aULx6wuQiwVsnzsi9d3WxzV3FpWTGA19F621kwdbsAcFKXgKUHZWsy+mY6iL1sHTxWEFCytDA==",
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.2.tgz",
+      "integrity": "sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==",
      "dev": true,
+      "license": "MIT",
      "dependencies": {
        "balanced-match": "^1.0.0"
      }
--- a/nodejs/src/connection.rs
+++ b/nodejs/src/connection.rs
@@ -2,12 +2,14 @@
 // SPDX-FileCopyrightText: Copyright The LanceDB Authors

 use std::collections::HashMap;
+use std::sync::Arc;

 use lancedb::database::CreateTableMode;
 use napi::bindgen_prelude::*;
 use napi_derive::*;

 use crate::error::NapiErrorExt;
+use crate::header::JsHeaderProvider;
 use crate::table::Table;
 use crate::ConnectionOptions;
 use lancedb::connection::{ConnectBuilder, Connection as LanceDBConnection};
@@ -45,7 +47,11 @@ impl Connection {
 impl Connection {
    /// Create a new Connection instance from the given URI.
    #[napi(factory)]
-    pub async fn new(uri: String, options: ConnectionOptions) -> napi::Result<Self> {
+    pub async fn new(
+        uri: String,
+        options: ConnectionOptions,
+        header_provider: Option<&JsHeaderProvider>,
+    ) -> napi::Result<Self> {
        let mut builder = ConnectBuilder::new(&uri);
        if let Some(interval) = options.read_consistency_interval {
            builder =
@@ -57,8 +63,16 @@ impl Connection {
            }
        }

+        // Create client config, optionally with header provider
        let client_config = options.client_config.unwrap_or_default();
-        builder = builder.client_config(client_config.into());
+        let mut rust_config: lancedb::remote::ClientConfig = client_config.into();
+
+        if let Some(provider) = header_provider {
+            rust_config.header_provider =
+                Some(Arc::new(provider.clone()) as Arc<dyn lancedb::remote::HeaderProvider>);
+        }
+
+        builder = builder.client_config(rust_config);

        if let Some(api_key) = options.api_key {
            builder = builder.api_key(&api_key);
--- a/nodejs/src/header.rs
+++ b/nodejs/src/header.rs
@@ -0,0 +1,71 @@
+// SPDX-License-Identifier: Apache-2.0
+// SPDX-FileCopyrightText: Copyright The LanceDB Authors
+
+use napi::{
+    bindgen_prelude::*,
+    threadsafe_function::{ErrorStrategy, ThreadsafeFunction},
+};
+use napi_derive::napi;
+use std::collections::HashMap;
+use std::sync::Arc;
+
+/// JavaScript HeaderProvider implementation that wraps a JavaScript callback.
+/// This is the only native header provider - all header provider implementations
+/// should provide a JavaScript function that returns headers.
+#[napi]
+pub struct JsHeaderProvider {
+    get_headers_fn: Arc<ThreadsafeFunction<(), ErrorStrategy::CalleeHandled>>,
+}
+
+impl Clone for JsHeaderProvider {
+    fn clone(&self) -> Self {
+        Self {
+            get_headers_fn: self.get_headers_fn.clone(),
+        }
+    }
+}
+
+#[napi]
+impl JsHeaderProvider {
+    /// Create a new JsHeaderProvider from a JavaScript callback
+    #[napi(constructor)]
+    pub fn new(get_headers_callback: JsFunction) -> Result<Self> {
+        let get_headers_fn = get_headers_callback
+            .create_threadsafe_function(0, |ctx| Ok(vec![ctx.value]))
+            .map_err(|e| {
+                Error::new(
+                    Status::GenericFailure,
+                    format!("Failed to create threadsafe function: {}", e),
+                )
+            })?;
+
+        Ok(Self {
+            get_headers_fn: Arc::new(get_headers_fn),
+        })
+    }
+}
+
+#[cfg(feature = "remote")]
+#[async_trait::async_trait]
+impl lancedb::remote::HeaderProvider for JsHeaderProvider {
+    async fn get_headers(&self) -> lancedb::error::Result<HashMap<String, String>> {
+        // Call the JavaScript function asynchronously
+        let promise: Promise<HashMap<String, String>> =
+            self.get_headers_fn.call_async(Ok(())).await.map_err(|e| {
+                lancedb::error::Error::Runtime {
+                    message: format!("Failed to call JavaScript get_headers: {}", e),
+                }
+            })?;
+
+        // Await the promise result
+        promise.await.map_err(|e| lancedb::error::Error::Runtime {
+            message: format!("JavaScript get_headers failed: {}", e),
+        })
+    }
+}
+
+impl std::fmt::Debug for JsHeaderProvider {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(f, "JsHeaderProvider")
+    }
+}
--- a/nodejs/src/lib.rs
+++ b/nodejs/src/lib.rs
@@ -8,6 +8,7 @@ use napi_derive::*;

 mod connection;
 mod error;
+mod header;
 mod index;
 mod iterator;
 pub mod merge;
--- a/nodejs/src/remote.rs
+++ b/nodejs/src/remote.rs
@@ -144,6 +144,7 @@ impl From<ClientConfig> for lancedb::remote::ClientConfig {
            extra_headers: config.extra_headers.unwrap_or_default(),
            id_delimiter: config.id_delimiter,
            tls_config: config.tls_config.map(Into::into),
+            header_provider: None, // the header provider is set separately later
        }
    }
 }