diff --git a/.changeset/fast-onions-own.md b/.changeset/fast-onions-own.md
new file mode 100644
index 0000000000..6977b035bc
--- /dev/null
+++ b/.changeset/fast-onions-own.md
@@ -0,0 +1,5 @@
+---
+'@backstage/backend-common': patch
+---
+
+`FetchUrlReader#readUrl()` now supports passing an optional `token` to authenticate requests.
diff --git a/packages/backend-common/src/reading/FetchUrlReader.test.ts b/packages/backend-common/src/reading/FetchUrlReader.test.ts
index ad834c64ef..7b5e4ebc05 100644
--- a/packages/backend-common/src/reading/FetchUrlReader.test.ts
+++ b/packages/backend-common/src/reading/FetchUrlReader.test.ts
@@ -223,6 +223,27 @@ describe('FetchUrlReader', () => {
       ).rejects.toThrow(NotModifiedError);
     });
 
+    it('should send Authorization header if token is provided', async () => {
+      expect.assertions(1);
+
+      worker.use(
+        rest.get(
+          'https://backstage.io/requires-authentication',
+          (req, res, ctx) => {
+            expect(req.headers.get('authorization')).toBe('Bearer mytoken');
+            return res(ctx.status(200));
+          },
+        ),
+      );
+
+      await fetchUrlReader.readUrl(
+        'https://backstage.io/requires-authentication',
+        {
+          token: 'mytoken',
+        },
+      );
+    });
+
     it('should return etag from the response', async () => {
       const response = await fetchUrlReader.readUrl(
         'https://backstage.io/some-resource',
diff --git a/packages/backend-common/src/reading/FetchUrlReader.ts b/packages/backend-common/src/reading/FetchUrlReader.ts
index 90c1cf6c26..475a98ffdc 100644
--- a/packages/backend-common/src/reading/FetchUrlReader.ts
+++ b/packages/backend-common/src/reading/FetchUrlReader.ts
@@ -131,6 +131,7 @@ export class FetchUrlReader implements UrlReader {
           ...(options?.lastModifiedAfter && {
             'If-Modified-Since': options.lastModifiedAfter.toUTCString(),
           }),
+          ...(options?.token && { Authorization: `Bearer ${options.token}` }),
         },
         // TODO(freben): The signal cast is there because pre-3.x versions of
         // node-fetch have a very slightly deviating AbortSignal type signature.