Reproducing a problem with a header is far better than “try again while I watch the dashboard”, and it must not be a way for anybody to trace everything.
$forced = $request->hasHeader('X-Debug-Trace')
&& hash_equals(config('trace.token'), $request->header('X-Debug-Trace'));
$sampled = $forced || random_int(1, 100) === 1;
// and it must be rate limited: a token that leaks is
// otherwise a way to make every request expensive.The token turns an unbounded cost into a controlled one, and rate limiting it is the second half — tracing is not free and a loop sending the header is a denial of service with a valid credential. Returning the trace id in a response header when forced is what makes it usable, since otherwise the person reproducing has to find their own trace among everything else.