diff --git a/client/client.yml b/client/client.yml
index 9f62990a321c1816acae5b13507444ee693bfcc7..56733a14b3eb5023efa380c013e2d1f486a363e1 100644
--- a/client/client.yml
+++ b/client/client.yml
@@ -16,6 +16,10 @@
 #         command: 'echo "$message"'
 #         if:
 #             priority: high,urgent
+#       - topic: secret
+#         command: 'notify-send "$m"'
+#         user: phill
+#         password: mypass
 #
 # Variables:
 #     Variable        Aliases               Description
diff --git a/client/config.go b/client/config.go
index c44fac6c1baae80e05c9941df7f0ed5c3516b054..0866cd1bfc1264749b58692a981e736209d08574 100644
--- a/client/config.go
+++ b/client/config.go
@@ -14,9 +14,11 @@ const (
 type Config struct {
 	DefaultHost string `yaml:"default-host"`
 	Subscribe   []struct {
-		Topic   string            `yaml:"topic"`
-		Command string            `yaml:"command"`
-		If      map[string]string `yaml:"if"`
+		Topic    string            `yaml:"topic"`
+		User     string            `yaml:"user"`
+		Password string            `yaml:"password"`
+		Command  string            `yaml:"command"`
+		If       map[string]string `yaml:"if"`
 	} `yaml:"subscribe"`
 }
 
diff --git a/client/config_test.go b/client/config_test.go
index 8d322111794f0db1262c230a25cd41d1f2910742..d601cdb4ffe1eb2ef4337736e1299deb5ce56e31 100644
--- a/client/config_test.go
+++ b/client/config_test.go
@@ -13,7 +13,9 @@ func TestConfig_Load(t *testing.T) {
 	require.Nil(t, os.WriteFile(filename, []byte(`
 default-host: http://localhost
 subscribe:
-  - topic: no-command
+  - topic: no-command-with-auth
+    user: phil
+    password: mypass
   - topic: echo-this
     command: 'echo "Message received: $message"'
   - topic: alerts
@@ -26,8 +28,10 @@ subscribe:
 	require.Nil(t, err)
 	require.Equal(t, "http://localhost", conf.DefaultHost)
 	require.Equal(t, 3, len(conf.Subscribe))
-	require.Equal(t, "no-command", conf.Subscribe[0].Topic)
+	require.Equal(t, "no-command-with-auth", conf.Subscribe[0].Topic)
 	require.Equal(t, "", conf.Subscribe[0].Command)
+	require.Equal(t, "phil", conf.Subscribe[0].User)
+	require.Equal(t, "mypass", conf.Subscribe[0].Password)
 	require.Equal(t, "echo-this", conf.Subscribe[1].Topic)
 	require.Equal(t, `echo "Message received: $message"`, conf.Subscribe[1].Command)
 	require.Equal(t, "alerts", conf.Subscribe[2].Topic)
diff --git a/cmd/subscribe.go b/cmd/subscribe.go
index 739176e8600357504b0719987a90ef68112501e4..9000a163497b58faebd746b1e68ba552f490be4b 100644
--- a/cmd/subscribe.go
+++ b/cmd/subscribe.go
@@ -162,6 +162,9 @@ func doSubscribe(c *cli.Context, cl *client.Client, conf *client.Config, topic,
 		for filter, value := range s.If {
 			topicOptions = append(topicOptions, client.WithFilter(filter, value))
 		}
+		if s.User != "" && s.Password != "" {
+			topicOptions = append(topicOptions, client.WithBasicAuth(s.User, s.Password))
+		}
 		subscriptionID := cl.Subscribe(s.Topic, topicOptions...)
 		commands[subscriptionID] = s.Command
 	}