Include multiple headers in python requests

In request.get() the headers argument should be defined as a dictionary, a set of key/value pairs. You've defined a set (a unique list) of strings instead.

You should declare your headers like this:

headers = {
    "projectName": "zhikovapp",
    "Authorization": "Bearer HZCdsf="
}
response = requests.get(bl_url, headers=headers)

Note the "key": "value" format of each line inside the dictionary.

Edit: Your Access-Control-Allow-Headers say they'll accept projectname and authorization in lower case. You've named your header projectName and Authorization with upper case letters in them. If they don't match, they'll be rejected.

1. If you have $today defined in the shell you make curl call from, and you don't substitute it in the requests' call URL, then it's a likely reason for the 400 Bad Request.
2. Access-Control-* and other CORS headers have nothing to do with non-browser clients. Also HTTP headers are generally case insensitive.

3. Following @furas's advice here's the output:

   $ curl -H "projectName: zhikovapp" -H "Authorization: Bearer HZCdsf=" \
       http://httpbin.org/get
   
   {
      "args": {}, 
      "headers": {
         "Accept": "*/*", 
         "Authorization": "Bearer HZCdsf=", 
         "Host": "httpbin.org", 
         "Projectname": "zhikovapp", 
         "User-Agent": "curl/7.35.0"
      }, 
      "origin": "1.2.3.4", 
      "url": "http://httpbin.org/get"
   }
   

   And the same request with requests:

   import requests
   res = requests.get('http://httpbin.org/get', headers={
     "projectName"   : "zhikovapp",
     "Authorization" : "Bearer HZCdsf="
   })
   print(res.json())
   
   {
     'args': {},
     'headers': {
        'Accept': '*/*',
        'Accept-Encoding': 'gzip, deflate, compress',
        'Authorization': 'Bearer HZCdsf=',
        'Host': 'httpbin.org',
        'Projectname': 'zhikovapp',
        'User-Agent': 'python-requests/2.2.1 CPython/3.4.3 '
          'Linux/3.16.0-38-generic'
      },
      'origin': '1.2.3.4',
      'url': 'http://httpbin.org/get'
   }
   

   As you can see the only difference is User-Agent header. It's unlikely the cause but you can easily set it in headers to the value you like.