diff --git a/lib/plugin-api.ts b/lib/plugin-api.ts
index d01f4b1e..3c0411b9 100644
--- a/lib/plugin-api.ts
+++ b/lib/plugin-api.ts
@@ -25,6 +25,7 @@ import {
   sidebarAppHooks,
 } from './plugin-hooks';
 import { toast as appToast } from '@/stores/toast-store';
+import { useAuthStore } from '@/stores/auth-store';
 
 // ─── Permission helpers ──────────────────────────────────────
 
@@ -128,6 +129,9 @@ export interface PluginAPI {
     info: (message: string) => void;
     warning: (message: string) => void;
   };
+  auth: {
+    getHeaders: () => Record<string, string>;
+  };
   storage: ReturnType<typeof createPluginStorage>;
   log: ReturnType<typeof createPluginLogger>;
   admin: {
@@ -640,6 +644,18 @@ export function createPluginAPI(plugin: InstalledPlugin): PluginAPI {
       warning: (message: string) => appToast.warning(message),
     },
 
+    auth: {
+      getHeaders: (): Record<string, string> => {
+        requirePermission(plugin, 'auth:read');
+        const { client } = useAuthStore.getState();
+        if (!client) return {};
+        return {
+          'Authorization': client.getAuthHeader(),
+          'X-JMAP-Username': client.getUsername(),
+        };
+      },
+    },
+
     storage: createPluginStorage(plugin.id),
     log: createPluginLogger(plugin.id),
 
diff --git a/lib/plugin-types.ts b/lib/plugin-types.ts
index e53ee087..aebdfb90 100644
--- a/lib/plugin-types.ts
+++ b/lib/plugin-types.ts
@@ -401,7 +401,7 @@ export const ALL_PERMISSIONS = [
   'vacation:read', 'vacation:write',
   'settings:read', 'settings:write',
   'security:read',
-  'auth:observe',
+  'auth:observe', 'auth:read',
   'ui:observe', 'ui:toolbar', 'ui:email-banner', 'ui:email-footer',
   'ui:composer-toolbar', 'ui:sidebar-widget', 'ui:settings-section',
   'ui:context-menu', 'ui:navigation-rail', 'ui:keyboard',