diff --git a/examples/auth.pp b/examples/auth.pp
new file mode 100644
index 0000000000..e395b78e19
--- /dev/null
+++ b/examples/auth.pp
@@ -0,0 +1,17 @@
+include 'apt'
+
+apt::auth { 'example':
+  machine  => 'apt.example.com',
+  login    => 'insecure-username',
+  password => 'insecure-password',
+}
+
+apt::source { 'puppetlabs':
+  location => 'https://apt-enterprise.puppetlabs.com',
+  repos    => 'main',
+  keyring  => '/usr/share/keyrings/puppetlabs.gpg',
+  auth     => {
+    login    => 'insecure-username',
+    password => 'insecure-password',
+  },
+}
diff --git a/manifests/source.pp b/manifests/source.pp
index 05c6b07682..9f7111969d 100644
--- a/manifests/source.pp
+++ b/manifests/source.pp
@@ -65,6 +65,11 @@
 # @option include [Boolean] :src
 #   Specifies whether to request the distribution's uncompiled source code.
 #
+# @param auth
+#   Creates an `apt::auth` resource using the `location` as machine scope.
+#   Valid hash keys include `login` and `password`. See `Apt::Auth_conf_entry`
+#   for more information.
+#
 # @param key
 #   Creates an `apt::keyring` in `/etc/apt/keyrings` (or anywhere on disk given `filename`) Valid options:
 #     * a hash of `parameter => value` pairs to be passed to `file`: `name` (title), `content`, `source`, `filename`
@@ -110,6 +115,7 @@
   Optional[Variant[String[0], Array[String[0]]]] $release = undef,
   Variant[String[1], Array[String[1]]] $repos = 'main',
   Hash $include = {},
+  Optional[Variant[String[1], Hash]] $auth = undef,
   Optional[Variant[String[1], Hash]] $key = undef,
   Optional[Stdlib::AbsolutePath] $keyring = undef,
   Optional[Variant[Hash, Integer, String[1]]] $pin = undef,
@@ -161,6 +167,28 @@
 
       $includes = $apt::include_defaults + $include
 
+      if $auth {
+        $_auth_ensure = pick($auth['ensure'], $ensure)
+        $_auth_login = pick_default($auth['login'])
+        $_auth_password = pick_default($auth['password'])
+
+        if $_auth_ensure == 'present' and empty($_auth_login) {
+          fail('auth must provide a valid username')
+        }
+
+        if $_auth_ensure == 'present' and empty($_auth_password) {
+          fail('auth must provide a valid password')
+        }
+
+        apt::auth { "Add auth: ${_location} from Apt::Source ${title}":
+          ensure   => $_auth_ensure,
+          name     => $name,
+          machine  => $_location,
+          login    => $_auth_login,
+          password => $_auth_password,
+        }
+      }
+
       if $keyring {
         if $key {
           fail('parameters key and keyring are mutually exclusive')
diff --git a/spec/defines/source_spec.rb b/spec/defines/source_spec.rb
index 4d18c7f157..e843efd5fe 100644
--- a/spec/defines/source_spec.rb
+++ b/spec/defines/source_spec.rb
@@ -435,6 +435,87 @@
     end
   end
 
+  describe 'auth parameter' do
+    context 'with auth set' do
+      let :params do
+        {
+          location: 'https://apt.spec.test/debian',
+          auth: {
+            login: 'spec',
+            password: 'test'
+          }
+        }
+      end
+
+      it {
+        expect(subject).to contain_apt__auth("Add auth: #{params[:location]} from Apt::Source #{title}")
+          .with(
+            ensure: 'present',
+            name: title,
+            machine: params[:location],
+            login: 'spec',
+            password: 'test',
+          )
+      }
+
+      it {
+        expect(subject).to contain_file("/etc/apt/auth.conf.d/#{title}.conf")
+      }
+    end
+
+    context 'with ensure set' do
+      let :params do
+        {
+          location: 'https://apt.spec.test/debian',
+          auth: {
+            ensure: 'absent',
+          }
+        }
+      end
+
+      it {
+        expect(subject).to contain_apt__auth("Add auth: #{params[:location]} from Apt::Source #{title}")
+          .with(
+            ensure: 'absent',
+            name: title,
+            machine: params[:location],
+            login: '',
+            password: '',
+          )
+      }
+    end
+
+    context 'with missing username' do
+      let :params do
+        {
+          location: 'https://apt.spec.test/debian',
+          auth: {
+            password: 'test',
+          }
+        }
+      end
+
+      it {
+        expect(subject).to compile.and_raise_error(%r{auth must provide a valid username})
+      }
+    end
+
+    context 'with missing password' do
+      let :params do
+        {
+          location: 'https://apt.spec.test/debian',
+          auth: {
+            login: 'spec',
+          }
+        }
+      end
+
+      it {
+        expect(subject).to compile.and_raise_error(%r{auth must provide a valid password})
+      }
+    end
+  end
+
   describe 'deb822 sources' do
     context 'suite contains a slash but does not end with slash (should require Components)' do
       let :params do