diff --git a/packages/core-components/src/layout/ProxiedSignInPage/ProxiedSignInIdentity.ts b/packages/core-components/src/layout/ProxiedSignInPage/ProxiedSignInIdentity.ts
index 7633fc43c3..c8b4d66837 100644
--- a/packages/core-components/src/layout/ProxiedSignInPage/ProxiedSignInIdentity.ts
+++ b/packages/core-components/src/layout/ProxiedSignInPage/ProxiedSignInIdentity.ts
@@ -51,6 +51,7 @@ export function tokenToExpiry(jwtToken: string | undefined): Date {
 type ProxiedSignInIdentityOptions = {
   provider: string;
   discoveryApi: typeof discoveryApiRef.T;
+  getHeaders?: () => Promise<HeadersInit>;
 };
 
 type State =
@@ -192,6 +193,7 @@ export class ProxiedSignInIdentity implements IdentityApi {
 
   async fetchSession(): Promise<ProxiedSession> {
     const baseUrl = await this.options.discoveryApi.getBaseUrl('auth');
+    const headers = await this.options.getHeaders?.();
 
     // Note that we do not use the fetchApi here, since this all happens before
     // sign-in completes so there can be no automatic token injection and
@@ -200,7 +202,7 @@ export class ProxiedSignInIdentity implements IdentityApi {
       `${baseUrl}/${this.options.provider}/refresh`,
       {
         signal: this.abortController.signal,
-        headers: { 'x-requested-with': 'XMLHttpRequest' },
+        headers: { ...headers, 'x-requested-with': 'XMLHttpRequest' },
         credentials: 'include',
       },
     );
diff --git a/packages/core-components/src/layout/ProxiedSignInPage/ProxiedSignInPage.tsx b/packages/core-components/src/layout/ProxiedSignInPage/ProxiedSignInPage.tsx
index 965c603004..78ca5a8e84 100644
--- a/packages/core-components/src/layout/ProxiedSignInPage/ProxiedSignInPage.tsx
+++ b/packages/core-components/src/layout/ProxiedSignInPage/ProxiedSignInPage.tsx
@@ -36,6 +36,12 @@ export type ProxiedSignInPageProps = SignInPageProps & {
    * a properly configured auth provider ID in the auth backend.
    */
   provider: string;
+
+  /**
+   * An optional function which returns a promise resolving with any headers
+   * that need to be added to the call made to /refresh endpoint.
+   */
+  getHeaders?: () => Promise<HeadersInit>;
 };
 
 /**
@@ -60,6 +66,7 @@ export const ProxiedSignInPage = (props: ProxiedSignInPageProps) => {
     const identity = new ProxiedSignInIdentity({
       provider: props.provider,
       discoveryApi,
+      getHeaders: props.getHeaders,
     });
 
     await identity.start();