diff --git a/bootstrap/crds/main.tf b/bootstrap/crds/main.tf
index 35644a0..fe3401d 100644
--- a/bootstrap/crds/main.tf
+++ b/bootstrap/crds/main.tf
@@ -60,6 +60,10 @@ resource "kubernetes_manifest" "customresourcedefinition_ogmiosports_demeter_run
               "properties" = {
                 "spec" = {
                   "properties" = {
+                    "authToken" = {
+                      "nullable" = true
+                      "type" = "string"
+                    }
                     "network" = {
                       "type" = "string"
                     }
diff --git a/operator/src/controller.rs b/operator/src/controller.rs
index c85113e..305ca4f 100644
--- a/operator/src/controller.rs
+++ b/operator/src/controller.rs
@@ -37,6 +37,7 @@ pub struct OgmiosPortSpec {
     pub version: u8,
     // throughput should be 0, 1, 2
     pub throughput_tier: String,
+    pub auth_token: Option<String>,
 }
 
 #[derive(Deserialize, Serialize, Clone, Default, Debug, JsonSchema)]
@@ -58,7 +59,10 @@ impl Context {
 }
 
 async fn reconcile(crd: Arc<OgmiosPort>, ctx: Arc<Context>) -> Result<Action> {
-    let key = build_api_key(&crd).await?;
+    let key = match &crd.spec.auth_token {
+        Some(api_key) => api_key.clone(),
+        None => build_api_key(&crd).await?,
+    };
 
     let (hostname, hostname_key) = build_hostname(&crd.spec.network, &crd.spec.version, &key);