diff --git a/pentesterflow_burp.py b/pentesterflow_burp.py
index 6158da7..0e53c13 100644
--- a/pentesterflow_burp.py
+++ b/pentesterflow_burp.py
@@ -34,6 +34,7 @@ def registerExtenderCallbacks(self, callbacks):
         self.callbacks = callbacks
         self.helpers = callbacks.getHelpers()
         self.base_url = DEFAULT_BASE_URL
+        self.bridge_token = ""
         self.auto_import_issues = False
         self.auto_send_proxy = False
         self.auto_send_repeater = False
@@ -60,6 +61,9 @@ def getUiComponent(self):
         top.add(JLabel("PentesterFlow URL:"))
         self.url_field = JTextField(self.base_url, 32)
         top.add(self.url_field)
+        top.add(JLabel("Token:"))
+        self.token_field = JTextField(self.bridge_token, 40)
+        top.add(self.token_field)
 
         save = JButton("Save", actionPerformed=self._save_settings)
         status = JButton("Check Status", actionPerformed=self._check_status)
@@ -106,6 +110,7 @@ def createMenuItems(self, invocation):
 
     def _save_settings(self, _event):
         self.base_url = self.url_field.getText().strip().rstrip("/") or DEFAULT_BASE_URL
+        self.bridge_token = self.token_field.getText().strip()
         self.auto_import_issues = self.auto_box.isSelected()
         self.auto_send_proxy = self.auto_proxy_box.isSelected()
         self.auto_send_repeater = self.auto_repeater_box.isSelected()
@@ -383,16 +388,19 @@ def _remember_auto_key(self, key):
             old = self.auto_sent_order.pop(0)
             self.auto_sent_keys.discard(old)
 
+    def _auth_headers(self):
+        if self.bridge_token:
+            return {"X-Pentesterflow-Token": self.bridge_token}
+        return {}
+
     def _post_json(self, path, payload):
         body = json.dumps(payload).encode("utf-8")
-        req = urllib2.Request(
-            self.base_url + path,
-            body,
-            {
-                "Accept": "application/json; charset=utf-8",
-                "Content-Type": "application/json; charset=utf-8",
-            },
-        )
+        headers = {
+            "Accept": "application/json; charset=utf-8",
+            "Content-Type": "application/json; charset=utf-8",
+        }
+        headers.update(self._auth_headers())
+        req = urllib2.Request(self.base_url + path, body, headers)
         res = urllib2.urlopen(req, timeout=10)
         status = res.getcode()
         text = res.read()
@@ -401,7 +409,8 @@ def _post_json(self, path, payload):
         return text
 
     def _get_json(self, path):
-        res = urllib2.urlopen(self.base_url + path, timeout=10)
+        req = urllib2.Request(self.base_url + path, headers=self._auth_headers())
+        res = urllib2.urlopen(req, timeout=10)
         text = res.read()
         return self._decode_json_response(path, text)
 
@@ -487,7 +496,7 @@ def _safe_unicode(self, value):
                 return u"<unprintable>"
 
     def _delete(self, path):
-        req = urllib2.Request(self.base_url + path)
+        req = urllib2.Request(self.base_url + path, headers=self._auth_headers())
         req.get_method = lambda: "DELETE"
         res = urllib2.urlopen(req, timeout=10)
         return res.read()