diff --git a/packages/backend-common/src/reading/GithubUrlReader.test.ts b/packages/backend-common/src/reading/GithubUrlReader.test.ts
index ec775183b3..f07ada0cc3 100644
--- a/packages/backend-common/src/reading/GithubUrlReader.test.ts
+++ b/packages/backend-common/src/reading/GithubUrlReader.test.ts
@@ -46,7 +46,7 @@ const treeResponseFactory = DefaultReadTreeResponseFactory.create({
 
 const mockCredentialsProvider = {
   getCredentials: jest.fn().mockResolvedValue({ headers: {} }),
-} as unknown as GithubCredentialsProvider;
+} satisfies GithubCredentialsProvider;
 
 const githubProcessor = new GithubUrlReader(
   new GithubIntegration(
@@ -105,7 +105,7 @@ describe('GithubUrlReader', () => {
         otherheader: 'something',
       };
 
-      (mockCredentialsProvider.getCredentials as jest.Mock).mockResolvedValue({
+      mockCredentialsProvider.getCredentials.mockResolvedValue({
         headers: mockHeaders,
       });
 
@@ -146,7 +146,7 @@ describe('GithubUrlReader', () => {
         otherheader: 'something',
       };
 
-      (mockCredentialsProvider.getCredentials as jest.Mock).mockResolvedValue({
+      mockCredentialsProvider.getCredentials.mockResolvedValue({
         headers: mockHeaders,
       });
 
@@ -182,7 +182,7 @@ describe('GithubUrlReader', () => {
         otherheader: 'something',
       };
 
-      (mockCredentialsProvider.getCredentials as jest.Mock).mockResolvedValue({
+      mockCredentialsProvider.getCredentials.mockResolvedValue({
         headers: mockHeaders,
       });
 
@@ -241,7 +241,7 @@ describe('GithubUrlReader', () => {
     });
 
     it('should return etag and last-modified from the response', async () => {
-      (mockCredentialsProvider.getCredentials as jest.Mock).mockResolvedValue({
+      mockCredentialsProvider.getCredentials.mockResolvedValue({
         headers: {
           Authorization: 'bearer blah',
         },
@@ -275,7 +275,7 @@ describe('GithubUrlReader', () => {
     it('should override the token if its provided', async () => {
       expect.assertions(1);
 
-      (mockCredentialsProvider.getCredentials as jest.Mock).mockResolvedValue({
+      mockCredentialsProvider.getCredentials.mockResolvedValue({
         headers: {
           Authorization: 'bearer blah',
         },
@@ -458,7 +458,7 @@ describe('GithubUrlReader', () => {
         otherheader: 'something',
       };
 
-      (mockCredentialsProvider.getCredentials as jest.Mock).mockResolvedValue({
+      mockCredentialsProvider.getCredentials.mockResolvedValue({
         headers: mockHeaders,
       });
 
@@ -497,7 +497,7 @@ describe('GithubUrlReader', () => {
         Authorization: 'bearer blah',
       };
 
-      (mockCredentialsProvider.getCredentials as jest.Mock).mockResolvedValue({
+      mockCredentialsProvider.getCredentials.mockResolvedValue({
         headers: mockHeaders,
       });
 
@@ -970,6 +970,34 @@ describe('GithubUrlReader', () => {
       await runTests(gheProcessor, 'https://ghe.github.com');
     });
 
+    it('passes through a token for the search request', async () => {
+      expect.assertions(1);
+
+      worker.use(
+        rest.get(
+          'https://ghe.github.com/api/v3/repos/backstage/mock/git/trees/etag123abc',
+          (req, res, ctx) => {
+            expect(req.headers.get('authorization')).toBe(
+              'Bearer overridentoken',
+            );
+            return res(
+              ctx.status(200),
+              ctx.set('Content-Type', 'application/json'),
+              ctx.json({
+                truncated: true,
+                tree: [],
+              } as Partial<GhTreeResponse>),
+            );
+          },
+        ),
+      );
+
+      await gheProcessor.search(
+        `https://ghe.github.com/backstage/mock/tree/main/**/*`,
+        { token: 'overridentoken' },
+      );
+    });
+
     // eslint-disable-next-line jest/expect-expect
     it('succeeds on ghe when going via readTree', async () => {
       worker.use(
diff --git a/packages/backend-common/src/reading/GithubUrlReader.ts b/packages/backend-common/src/reading/GithubUrlReader.ts
index b476435771..b49945013d 100644
--- a/packages/backend-common/src/reading/GithubUrlReader.ts
+++ b/packages/backend-common/src/reading/GithubUrlReader.ts
@@ -185,9 +185,7 @@ export class GithubUrlReader implements UrlReader {
     }
 
     const { filepath } = parseGitUrl(url);
-    const { headers } = await this.deps.credentialsProvider.getCredentials({
-      url,
-    });
+    const { headers } = await this.getCredentials(url, options);
 
     const files = await this.doSearch(
       url,
diff --git a/packages/backend-plugin-api/src/services/definitions/UrlReaderService.ts b/packages/backend-plugin-api/src/services/definitions/UrlReaderService.ts
index e89deab0eb..734dcd9902 100644
--- a/packages/backend-plugin-api/src/services/definitions/UrlReaderService.ts
+++ b/packages/backend-plugin-api/src/services/definitions/UrlReaderService.ts
@@ -305,6 +305,18 @@ export type SearchOptions = {
    * Not all reader implementations may take this field into account.
    */
   signal?: AbortSignal;
+
+  /**
+   * An optional token to use for authentication when reading the resources.
+   *
+   * @remarks
+   *
+   * By default all URL Readers will use the integrations config which is supplied
+   * when creating the Readers. Sometimes it might be desireable to use the already
+   * created URLReaders but with a different token, maybe that's supplied by the user
+   * at runtime.
+   */
+  token?: string;
 };
 
 /**