diff --git a/bootstrap/crds/main.tf b/bootstrap/crds/main.tf
index f06f796..ae3f75c 100644
--- a/bootstrap/crds/main.tf
+++ b/bootstrap/crds/main.tf
@@ -55,6 +55,10 @@ resource "kubernetes_manifest" "customresourcedefinition_scrollsports_demeter_ru
               "properties" = {
                 "spec" = {
                   "properties" = {
+                    "authToken" = {
+                      "nullable" = true
+                      "type" = "string"
+                    }
                     "network" = {
                       "type" = "string"
                     }
diff --git a/operator/src/controller.rs b/operator/src/controller.rs
index 405d9e3..3ed1607 100644
--- a/operator/src/controller.rs
+++ b/operator/src/controller.rs
@@ -45,6 +45,7 @@ pub struct ScrollsPortSpec {
     pub network: String,
     pub throughput_tier: String,
     pub version: String,
+    pub auth_token: Option<String>,
 }
 
 #[derive(Deserialize, Serialize, Clone, Default, Debug, JsonSchema)]
@@ -56,7 +57,11 @@ pub struct ScrollsPortStatus {
 }
 
 async fn reconcile(crd: Arc<ScrollsPort>, ctx: Arc<Context>) -> Result<Action> {
-    let key = build_api_key(&crd).await?;
+    let key = match &crd.spec.auth_token {
+        Some(key) => key.clone(),
+        None => build_api_key(&crd).await?,
+    };
+
     let (hostname, hostname_key) = build_hostname(&key);
 
     let status = ScrollsPortStatus {