diff --git a/.changeset/curvy-keys-leave.md b/.changeset/curvy-keys-leave.md
new file mode 100644
index 0000000000..a48cc15fb8
--- /dev/null
+++ b/.changeset/curvy-keys-leave.md
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-kafka-backend': patch
+---
+
+Add support for SASL authentication & SSL boolean config.
diff --git a/plugins/kafka-backend/README.md b/plugins/kafka-backend/README.md
index 13078ea816..14914e5ba6 100644
--- a/plugins/kafka-backend/README.md
+++ b/plugins/kafka-backend/README.md
@@ -6,15 +6,15 @@ This is the backend part of the Kafka plugin. It responds to Kafka requests from
 
 This configures how to connect to the brokers in your Kafka cluster.
 
-### clientId
+### `clientId`
 
 The name of the client to use when connecting to the cluster.
 
-### brokers
+### `brokers`
 
 A list of the brokers' host names and ports to connect to.
 
-### SSL (optional)
+### `ssl` (optional)
 
 Configure TLS connection to the Kafka cluster. The options are passed directly to [tls.connect] and used to create the TLS secure context. Normally these would include `key` and `cert`.
 
@@ -24,7 +24,25 @@ Example:
 kafka:
   clientId: backstage
   clusters:
-    name: prod
-    brokers:
-      - localhost:9092
+    - name: prod
+      brokers:
+        - localhost:9092
+```
+
+### `sasl` (optional)
+
+Configure SASL authentication for the Kafka client.
+
+```yaml
+kafka:
+  clientId: backstage
+  clusters:
+    - name: prod
+      brokers:
+        - my-cluser:9092
+      ssl: true
+      sasl:
+        mechanism: plain # or 'scram-sha-256' or 'scram-sha-512'
+        username: my-username
+        password: my-password
 ```
diff --git a/plugins/kafka-backend/config.d.ts b/plugins/kafka-backend/config.d.ts
index 87254b152c..fbfcd2cb53 100644
--- a/plugins/kafka-backend/config.d.ts
+++ b/plugins/kafka-backend/config.d.ts
@@ -29,11 +29,22 @@ export interface Config {
        * Optional SSL connection parameters to connect to the cluster. Passed directly to Node tls.connect.
        * See https://nodejs.org/dist/latest-v8.x/docs/api/tls.html#tls_tls_createsecurecontext_options
        */
-      ssl?: {
-        ca: string[];
+      ssl?:
+        | {
+            ca: string[];
+            /** @visibility secret */
+            key: string;
+            cert: string;
+          }
+        | boolean;
+      /**
+       * Optional SASL connection parameters.
+       */
+      sasl?: {
+        mechanism: 'plain' | 'scram-sha-256' | 'scram-sha-512';
+        username: string;
         /** @visibility secret */
-        key: string;
-        cert: string;
+        password: string;
       };
     }[];
   };
diff --git a/plugins/kafka-backend/src/config/ClusterReader.ts b/plugins/kafka-backend/src/config/ClusterReader.ts
index a4e6a4e4fe..91f7b5d890 100644
--- a/plugins/kafka-backend/src/config/ClusterReader.ts
+++ b/plugins/kafka-backend/src/config/ClusterReader.ts
@@ -15,8 +15,7 @@
  */
 
 import { Config } from '@backstage/config';
-import { ConnectionOptions } from 'tls';
-import { ClusterDetails } from '../types/types';
+import { ClusterDetails, SslConfig, SaslConfig } from '../types/types';
 
 export function getClusterDetails(config: Config[]): ClusterDetails[] {
   return config.map(clusterConfig => {
@@ -24,14 +23,13 @@ export function getClusterDetails(config: Config[]): ClusterDetails[] {
       name: clusterConfig.getString('name'),
       brokers: clusterConfig.getStringArray('brokers'),
     };
-    const sslConfig = clusterConfig.getOptional('kafka.ssl');
-    if (sslConfig) {
-      return {
-        ...clusterDetails,
-        ssl: sslConfig as ConnectionOptions,
-      };
-    }
+    const ssl = clusterConfig.getOptional('ssl') as SslConfig;
+    const sasl = clusterConfig.getOptional('sasl') as SaslConfig;
 
-    return clusterDetails;
+    return {
+      ...clusterDetails,
+      ...(ssl ? { ssl } : {}),
+      ...(sasl ? { sasl } : {}),
+    };
   });
 }
diff --git a/plugins/kafka-backend/src/service/KafkaApi.ts b/plugins/kafka-backend/src/service/KafkaApi.ts
index 1eade40bf4..fe4af1cc58 100644
--- a/plugins/kafka-backend/src/service/KafkaApi.ts
+++ b/plugins/kafka-backend/src/service/KafkaApi.ts
@@ -16,7 +16,7 @@
 
 import { Kafka, SeekEntry } from 'kafkajs';
 import { Logger } from 'winston';
-import { ConnectionOptions } from 'tls';
+import { SaslConfig, SslConfig } from '../types/types';
 
 export type PartitionOffset = {
   id: number;
@@ -31,7 +31,8 @@ export type TopicOffset = {
 export type Options = {
   clientId: string;
   brokers: string[];
-  ssl?: ConnectionOptions;
+  ssl?: SslConfig;
+  sasl?: SaslConfig;
   logger: Logger;
 };
 
diff --git a/plugins/kafka-backend/src/types/types.ts b/plugins/kafka-backend/src/types/types.ts
index 5f70998dd8..2adbc84bf2 100644
--- a/plugins/kafka-backend/src/types/types.ts
+++ b/plugins/kafka-backend/src/types/types.ts
@@ -19,5 +19,14 @@ import { ConnectionOptions } from 'tls';
 export interface ClusterDetails {
   name: string;
   brokers: string[];
-  ssl?: ConnectionOptions;
+  ssl?: SslConfig;
+  sasl?: SaslConfig;
 }
+
+export type SslConfig = ConnectionOptions | boolean;
+
+export type SaslConfig = {
+  mechanism: 'plain' | 'scram-sha-256' | 'scram-sha-512';
+  username: string;
+  password: string;
+};
diff --git a/plugins/kafka/README.md b/plugins/kafka/README.md
index 395b3240ef..a2ea01cf7d 100644
--- a/plugins/kafka/README.md
+++ b/plugins/kafka/README.md
@@ -63,7 +63,9 @@ import { Router as KafkaRouter } from '@backstage/plugin-kafka';
 />;
 ```
 
-5. Add broker configs for the backend in your `app-config.yaml`:
+5. Add broker configs for the backend in your `app-config.yaml` (see
+   [kafka-backend](https://github.com/backstage/backstage/blob/master/plugins/kafka-backend/README.md)
+   for more options):
 
 ```yaml
 kafka: