Query : Custom HTTP headers

Hi , I wanted some guidance on if custom HTTP headers fall into Data or Profile extensions ? Profile extensions I think, but I could not get to a clear guidance on this explicitly.

Some background : We need clients to pass some custom headers for us to have some additional validations/processing in addition to the bearer token validation .

Thanks!