diff --git a/libfwupd/fwupd-enums.c b/libfwupd/fwupd-enums.c
index 984312f37..a58522c18 100644
--- a/libfwupd/fwupd-enums.c
+++ b/libfwupd/fwupd-enums.c
@@ -341,6 +341,8 @@ fwupd_plugin_flag_to_string (FwupdPluginFlags plugin_flag)
 		return "kernel-too-old";
 	if (plugin_flag == FWUPD_DEVICE_FLAG_UNKNOWN)
 		return "unknown";
+	if (plugin_flag == FWUPD_PLUGIN_FLAG_AUTH_REQUIRED)
+		return "auth-required";
 	return NULL;
 }
 
@@ -383,6 +385,8 @@ fwupd_plugin_flag_from_string (const gchar *plugin_flag)
 		return FWUPD_PLUGIN_FLAG_REQUIRE_HWID;
 	if (g_strcmp0 (plugin_flag, "kernel-too-old") == 0)
 		return FWUPD_PLUGIN_FLAG_KERNEL_TOO_OLD;
+	if (g_strcmp0 (plugin_flag, "auth-required") == 0)
+		return FWUPD_PLUGIN_FLAG_AUTH_REQUIRED;
 	return FWUPD_DEVICE_FLAG_UNKNOWN;
 }
 
diff --git a/libfwupd/fwupd-enums.h b/libfwupd/fwupd-enums.h
index 208b7689e..375ec4641 100644
--- a/libfwupd/fwupd-enums.h
+++ b/libfwupd/fwupd-enums.h
@@ -675,6 +675,15 @@ typedef enum {
  * Since: 1.6.2
  */
 #define FWUPD_PLUGIN_FLAG_KERNEL_TOO_OLD	(1u << 11)
+/**
+ * FWUPD_PLUGIN_FLAG_AUTH_REQUIRED:
+ *
+ * The plugin requires the user to provide authentication details.
+ * Supported clients will display this information to a user.
+ *
+ * Since: 1.6.2
+ */
+#define FWUPD_PLUGIN_FLAG_AUTH_REQUIRED		(1u << 12)
 /**
  * FWUPD_PLUGIN_FLAG_UNKNOWN:
  *
diff --git a/libfwupdplugin/fu-plugin.c b/libfwupdplugin/fu-plugin.c
index 971c99efd..b3e020e09 100644
--- a/libfwupdplugin/fu-plugin.c
+++ b/libfwupdplugin/fu-plugin.c
@@ -383,6 +383,8 @@ fu_plugin_build_device_update_error (FuPlugin *self)
 		return "Not updatable as UEFI capsule updates not enabled in firmware setup";
 	if (fu_plugin_has_flag (self, FWUPD_PLUGIN_FLAG_UNLOCK_REQUIRED))
 		return "Not updatable as requires unlock";
+	if (fu_plugin_has_flag (self, FWUPD_PLUGIN_FLAG_AUTH_REQUIRED))
+		return "Not updatable as requires authentication";
 	if (fu_plugin_has_flag (self, FWUPD_PLUGIN_FLAG_EFIVAR_NOT_MOUNTED))
 		return "Not updatable as efivarfs was not found";
 	if (fu_plugin_has_flag (self, FWUPD_PLUGIN_FLAG_ESP_NOT_FOUND))
diff --git a/src/fu-util-common.c b/src/fu-util-common.c
index 6f785648d..25e217d51 100644
--- a/src/fu-util-common.c
+++ b/src/fu-util-common.c
@@ -1447,6 +1447,10 @@ fu_util_plugin_flag_to_string (FwupdPluginFlags plugin_flag)
 		/* TRANSLATORS: user needs to run a command */
 		return _("Firmware updates disabled; run 'fwupdmgr unlock' to enable");
 	}
+	if (plugin_flag == FWUPD_PLUGIN_FLAG_AUTH_REQUIRED) {
+		/* TRANSLATORS: user needs to run a command */
+		return _("Authentication details are required");
+	}
 	if (plugin_flag == FWUPD_PLUGIN_FLAG_EFIVAR_NOT_MOUNTED) {
 		/* TRANSLATORS: the user is using Gentoo/Arch and has screwed something up */
 		return _("Required efivarfs filesystem was not found");
@@ -1487,6 +1491,7 @@ fu_util_plugin_flag_to_cli_text (FwupdPluginFlags plugin_flag)
 	case FWUPD_PLUGIN_FLAG_LEGACY_BIOS:
 	case FWUPD_PLUGIN_FLAG_CAPSULES_UNSUPPORTED:
 	case FWUPD_PLUGIN_FLAG_UNLOCK_REQUIRED:
+	case FWUPD_PLUGIN_FLAG_AUTH_REQUIRED:
 	case FWUPD_PLUGIN_FLAG_EFIVAR_NOT_MOUNTED:
 	case FWUPD_PLUGIN_FLAG_ESP_NOT_FOUND:
 	case FWUPD_PLUGIN_FLAG_KERNEL_TOO_OLD: