diff --git a/.changeset/nice-forks-remain.md b/.changeset/nice-forks-remain.md
new file mode 100644
index 0000000000..6d833ff283
--- /dev/null
+++ b/.changeset/nice-forks-remain.md
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-code-coverage': patch
+---
+
+Use fetchApi to ensure authorization is used when fetching code-coverage data
diff --git a/plugins/code-coverage/src/api.ts b/plugins/code-coverage/src/api.ts
index 081f1c7999..942e5a8a47 100644
--- a/plugins/code-coverage/src/api.ts
+++ b/plugins/code-coverage/src/api.ts
@@ -20,10 +20,13 @@ import {
 } from '@backstage/catalog-model';
 import { ResponseError } from '@backstage/errors';
 import { JsonCodeCoverage, JsonCoverageHistory } from './types';
-import { createApiRef, DiscoveryApi } from '@backstage/core-plugin-api';
+import {
+  createApiRef,
+  DiscoveryApi,
+  FetchApi,
+} from '@backstage/core-plugin-api';
 
 export type CodeCoverageApi = {
-  discovery: DiscoveryApi;
   getCoverageForEntity: (
     entity: CompoundEntityRef,
   ) => Promise<JsonCodeCoverage>;
@@ -42,18 +45,22 @@ export const codeCoverageApiRef = createApiRef<CodeCoverageApi>({
 });
 
 export class CodeCoverageRestApi implements CodeCoverageApi {
-  url: string = '';
+  private readonly discoveryApi: DiscoveryApi;
+  private readonly fetchApi: FetchApi;
 
-  constructor(public discovery: DiscoveryApi) {}
+  public constructor(options: {
+    discoveryApi: DiscoveryApi;
+    fetchApi: FetchApi;
+  }) {
+    this.discoveryApi = options.discoveryApi;
+    this.fetchApi = options.fetchApi;
+  }
 
   private async fetch<T = unknown | string | JsonCoverageHistory>(
     path: string,
-    init?: RequestInit,
   ): Promise<T | string> {
-    if (!this.url) {
-      this.url = await this.discovery.getBaseUrl('code-coverage');
-    }
-    const resp = await fetch(`${this.url}${path}`, init);
+    const url = await this.discoveryApi.getBaseUrl('code-coverage');
+    const resp = await this.fetchApi.fetch(`${url}${path}`);
     if (!resp.ok) {
       throw await ResponseError.fromResponse(resp);
     }
diff --git a/plugins/code-coverage/src/plugin.ts b/plugins/code-coverage/src/plugin.ts
index f137e9d488..391595f142 100644
--- a/plugins/code-coverage/src/plugin.ts
+++ b/plugins/code-coverage/src/plugin.ts
@@ -21,6 +21,7 @@ import {
   createPlugin,
   createRoutableExtension,
   discoveryApiRef,
+  fetchApiRef,
 } from '@backstage/core-plugin-api';
 
 /**
@@ -34,8 +35,9 @@ export const codeCoveragePlugin = createPlugin({
   apis: [
     createApiFactory({
       api: codeCoverageApiRef,
-      deps: { discoveryApi: discoveryApiRef },
-      factory: ({ discoveryApi }) => new CodeCoverageRestApi(discoveryApi),
+      deps: { discoveryApi: discoveryApiRef, fetchApi: fetchApiRef },
+      factory: ({ discoveryApi, fetchApi }) =>
+        new CodeCoverageRestApi({ discoveryApi, fetchApi }),
     }),
   ],
 });
diff --git a/yarn.lock b/yarn.lock
index 8661ef179d..1a10972dcb 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -17518,9 +17518,9 @@ __metadata:
   linkType: hard
 
 "@types/node@npm:^16.0.0, @types/node@npm:^16.11.26, @types/node@npm:^16.9.2":
-  version: 16.18.40
-  resolution: "@types/node@npm:16.18.40"
-  checksum: a683930491b4fd7cb2dc7684e32bbeedc4a83fb1949a7b15ea724fbfaa9988cec59091f169a3f1090cb91992caba8c1a7d50315b2c67c6e2579a3788bb09eec4
+  version: 16.18.41
+  resolution: "@types/node@npm:16.18.41"
+  checksum: b12650d8e4289edafcf0453c8a66c00d6397d465a48b1c683babba4f16f92a6418f678e98a85751e3fef78d23c2b07f641df8da14bf5428ad8282b57b2695243
   languageName: node
   linkType: hard
 
@@ -20181,13 +20181,13 @@ __metadata:
   linkType: hard
 
 "better-sqlite3@npm:^8.0.0":
-  version: 8.5.0
-  resolution: "better-sqlite3@npm:8.5.0"
+  version: 8.5.1
+  resolution: "better-sqlite3@npm:8.5.1"
   dependencies:
     bindings: ^1.5.0
     node-gyp: latest
     prebuild-install: ^7.1.0
-  checksum: 98243cb08a410fad0b5c443410428c8ea00376a4eb7d2c9a8a5a695970bc7a2a4007221930460939594d728e7d6bcb1889f46ec11a3bbb2257b996c80fbaacb1
+  checksum: ba06e7ae5d150f8d9dc77daff6299689476337b820fd82dae5bd844d39009c605e595758145b453362dc68e37041c285ae4cc73d63028b9e4a085b5ad2d3a2c4
   languageName: node
   linkType: hard