diff --git a/packages/backend-common/src/reading/GithubUrlReader.test.ts b/packages/backend-common/src/reading/GithubUrlReader.test.ts
index f842adcf90..1a0f27d28f 100644
--- a/packages/backend-common/src/reading/GithubUrlReader.test.ts
+++ b/packages/backend-common/src/reading/GithubUrlReader.test.ts
@@ -15,6 +15,7 @@
  */
 
 import { ConfigReader } from '@backstage/config';
+import { GithubCredentialsProvider } from '@backstage/integration';
 import { msw } from '@backstage/test-utils';
 import fs from 'fs';
 import { rest } from 'msw';
@@ -28,6 +29,18 @@ const treeResponseFactory = ReadTreeResponseFactory.create({
 });
 
 describe('GithubUrlReader', () => {
+  const mockCredentialsProvider = ({
+    getCredentials: jest.fn().mockResolvedValue({ headers: {} }),
+  } as unknown) as GithubCredentialsProvider;
+
+  const worker = setupServer();
+
+  msw.setupDefaultHandlers(worker);
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
   describe('implementation', () => {
     it('rejects unknown targets', async () => {
       const processor = new GithubUrlReader(
@@ -35,7 +48,7 @@ describe('GithubUrlReader', () => {
           host: 'github.com',
           apiBaseUrl: 'https://api.github.com',
         },
-        { treeResponseFactory },
+        { treeResponseFactory, credentialsProvider: mockCredentialsProvider },
       );
       await expect(
         processor.read('https://not.github.com/apa'),
@@ -45,11 +58,52 @@ describe('GithubUrlReader', () => {
     });
   });
 
+  describe('read', () => {
+    it('should use the headers from the credentials provider to the fetch request when doing read', async () => {
+      expect.assertions(2);
+
+      const mockHeaders = {
+        Authorization: 'bearer blah',
+        otherheader: 'something',
+      };
+
+      (mockCredentialsProvider.getCredentials as jest.Mock).mockResolvedValue({
+        headers: mockHeaders,
+      });
+
+      worker.use(
+        rest.get(
+          'https://api.github.com/repos/backstage/mock/tree/contents/?ref=repo',
+          (req, res, ctx) => {
+            expect(req.headers.get('authorization')).toBe(
+              mockHeaders.Authorization,
+            );
+            expect(req.headers.get('otherheader')).toBe(
+              mockHeaders.otherheader,
+            );
+            return res(
+              ctx.status(200),
+              ctx.set('Content-Type', 'application/x-gzip'),
+              ctx.body('foo'),
+            );
+          },
+        ),
+      );
+
+      const processor = new GithubUrlReader(
+        {
+          host: 'ghe.github.com',
+          apiBaseUrl: 'https://api.github.com',
+        },
+        { treeResponseFactory, credentialsProvider: mockCredentialsProvider },
+      );
+      await processor.read(
+        'https://ghe.github.com/backstage/mock/tree/blob/repo',
+      );
+    });
+  });
+
   describe('readTree', () => {
-    const worker = setupServer();
-
-    msw.setupDefaultHandlers(worker);
-
     const repoBuffer = fs.readFileSync(
       path.resolve('src', 'reading', '__fixtures__', 'repo.tar.gz'),
     );
@@ -74,7 +128,7 @@ describe('GithubUrlReader', () => {
           host: 'github.com',
           apiBaseUrl: 'https://api.github.com',
         },
-        { treeResponseFactory },
+        { treeResponseFactory, credentialsProvider: mockCredentialsProvider },
       );
 
       const response = await processor.readTree(
@@ -110,7 +164,7 @@ describe('GithubUrlReader', () => {
           host: 'ghe.github.com',
           apiBaseUrl: 'https://api.github.com',
         },
-        { treeResponseFactory },
+        { treeResponseFactory, credentialsProvider: mockCredentialsProvider },
       );
 
       const response = await processor.readTree(
@@ -125,13 +179,57 @@ describe('GithubUrlReader', () => {
       expect(indexMarkdownFile.toString()).toBe('# Test\n');
     });
 
+    it('should use the headers from the credentials provider to the fetch request', async () => {
+      expect.assertions(2);
+
+      const mockHeaders = {
+        Authorization: 'bearer blah',
+        otherheader: 'something',
+      };
+
+      (mockCredentialsProvider.getCredentials as jest.Mock).mockResolvedValue({
+        headers: mockHeaders,
+      });
+
+      worker.use(
+        rest.get(
+          'https://ghe.github.com/backstage/mock/archive/repo.tar.gz',
+          (req, res, ctx) => {
+            expect(req.headers.get('authorization')).toBe(
+              mockHeaders.Authorization,
+            );
+            expect(req.headers.get('otherheader')).toBe(
+              mockHeaders.otherheader,
+            );
+            return res(
+              ctx.status(200),
+              ctx.set('Content-Type', 'application/x-gzip'),
+              ctx.body(repoBuffer),
+            );
+          },
+        ),
+      );
+
+      const processor = new GithubUrlReader(
+        {
+          host: 'ghe.github.com',
+          apiBaseUrl: 'https://api.github.com',
+        },
+        { treeResponseFactory, credentialsProvider: mockCredentialsProvider },
+      );
+
+      await processor.readTree(
+        'https://ghe.github.com/backstage/mock/tree/repo/docs',
+      );
+    });
+
     it('must specify a branch', async () => {
       const processor = new GithubUrlReader(
         {
           host: 'github.com',
           apiBaseUrl: 'https://api.github.com',
         },
-        { treeResponseFactory },
+        { treeResponseFactory, credentialsProvider: mockCredentialsProvider },
       );
 
       await expect(
@@ -147,7 +245,7 @@ describe('GithubUrlReader', () => {
           host: 'github.com',
           apiBaseUrl: 'https://api.github.com',
         },
-        { treeResponseFactory },
+        { treeResponseFactory, credentialsProvider: mockCredentialsProvider },
       );
 
       const response = await processor.readTree(
diff --git a/yarn.lock b/yarn.lock
index 6986104789..e179b16698 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -18434,7 +18434,7 @@ modify-values@^1.0.0:
   resolved "https://registry.npmjs.org/modify-values/-/modify-values-1.0.1.tgz#b3939fa605546474e3e3e3c63d64bd43b4ee6022"
   integrity sha512-xV2bxeN6F7oYjZWTe/YPAy6MN2M+sL4u/Rlm2AHCIVGfo2p1yGmBHQ6vHehl4bRTZBdHu3TSkWdYgkwpYzAGSw==
 
-moment@^2.25.3, moment@^2.26.0, moment@^2.27.0, moment@^2.29.1:
+moment@^2.25.3, moment@^2.26.0, moment@^2.27.0:
   version "2.29.1"
   resolved "https://registry.npmjs.org/moment/-/moment-2.29.1.tgz#b2be769fa31940be9eeea6469c075e35006fa3d3"
   integrity sha512-kHmoybcPV8Sqy59DwNDY3Jefr64lK/by/da0ViFcuA4DH0vQg5Q6Ze5VimxkfQNSC+Mls/Kx53s7TjP1RhFEDQ==