diff --git a/.changeset/selfish-carrots-sneeze.md b/.changeset/selfish-carrots-sneeze.md
new file mode 100644
index 0000000000..e0a88744dc
--- /dev/null
+++ b/.changeset/selfish-carrots-sneeze.md
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-proxy-backend': patch
+---
+
+The headers `Authorization` and `X-Api-Key` are sensitive and must be declared a secret.
diff --git a/plugins/proxy-backend/config.d.ts b/plugins/proxy-backend/config.d.ts
index 59fc0dc5a6..410ff86a2e 100644
--- a/plugins/proxy-backend/config.d.ts
+++ b/plugins/proxy-backend/config.d.ts
@@ -31,7 +31,17 @@ export interface Config {
           /**
            * Object with extra headers to be added to target requests.
            */
-          headers?: { [key: string]: string };
+          headers?: Partial<{
+            /** @visibility secret */
+            Authorization: string;
+            /** @visibility secret */
+            authorization: string;
+            /** @visibility secret */
+            'X-Api-Key': string;
+            /** @visibility secret */
+            'x-api-key': string;
+            [key: string]: string;
+          }>;
           /**
            * Changes the origin of the host header to the target URL. Default: true.
            */