diff --git a/src/fetchers/tarball-fetcher.js b/src/fetchers/tarball-fetcher.js
index 460bc7d14b..689a05d539 100644
--- a/src/fetchers/tarball-fetcher.js
+++ b/src/fetchers/tarball-fetcher.js
@@ -131,12 +131,18 @@ export default class TarballFetcher extends BaseFetcher {
   fetchFromExternal(): Promise<FetchedOverride> {
     const {reference: ref} = this;
 
+    const headers: Object = {
+      'Accept-Encoding': 'gzip',
+      'Accept': 'application/octet-stream',
+    };
+
+    if (this.remote.auth && this.remote.auth.token) {
+      headers.authorization = `Bearer ${this.remote.auth.token}`;
+    }
+
     return this.config.requestManager.request({
       url: ref,
-      headers: {
-        'Accept-Encoding': 'gzip',
-        'Accept': 'application/octet-stream',
-      },
+      headers,
       buffer: true,
       process: (req, resolve, reject) => {
         // should we save this to the offline cache?
diff --git a/src/registries/npm-registry.js b/src/registries/npm-registry.js
index 872efd2138..02990492e4 100644
--- a/src/registries/npm-registry.js
+++ b/src/registries/npm-registry.js
@@ -126,6 +126,10 @@ export default class NpmRegistry extends Registry {
         await fs.mkdirp(mirrorLoc);
       }
 
+      if (config['_auth']) {
+        this.token = config['_auth'];
+      }
+
       defaults(this.config, config);
     }
   }
diff --git a/src/resolvers/registries/npm-resolver.js b/src/resolvers/registries/npm-resolver.js
index ff0655f332..85e73583e0 100644
--- a/src/resolvers/registries/npm-resolver.js
+++ b/src/resolvers/registries/npm-resolver.js
@@ -162,6 +162,9 @@ export default class NpmResolver extends RegistryResolver {
         reference: dist.tarball,
         hash: dist.shasum,
         registry: 'npm',
+        auth: {
+          token: this.config.registries.npm.token,
+        },
       };
     }
 
diff --git a/src/types.js b/src/types.js
index 517a9b1521..a7d6e87fa3 100644
--- a/src/types.js
+++ b/src/types.js
@@ -44,6 +44,12 @@ export type PackageRemote = {
   reference: string,
   resolved?: ?string,
   hash?: ?string,
+  auth?: {
+    email?: string,
+    username?: string,
+    password?: string,
+    token?: string,
+  }
 };
 
 // `dependencies` field in package info