diff --git a/grafana/provider.go b/grafana/provider.go
index bd06baa26..ec97eeb37 100644
--- a/grafana/provider.go
+++ b/grafana/provider.go
@@ -46,6 +46,13 @@ func Provider(version string) func() *schema.Provider {
 					DefaultFunc: schema.EnvDefaultFunc("GRAFANA_AUTH", nil),
 					Description: "API token or basic auth username:password. May alternatively be set via the `GRAFANA_AUTH` environment variable.",
 				},
+				"proxy_auth": {
+					Type:        schema.TypeString,
+					Required:    false,
+					Sensitive:   true,
+					DefaultFunc: schema.EnvDefaultFunc("GRAFANA_PROXY_AUTH", nil),
+					Description: "API token. May alternatively be set via the `GRAFANA_PROXY_AUTH` environment variable.",
+				},
 				"org_id": {
 					Type:        schema.TypeInt,
 					Required:    true,
@@ -140,6 +147,11 @@ func configure(version string, p *schema.Provider) func(context.Context, *schema
 		c := &client{}
 
 		auth := strings.SplitN(d.Get("auth").(string), ":", 2)
+		pa := d.Get("proxy_auth")
+		var proxyAuth string
+		if pa != nil {
+			proxyAuth = d.Get("proxy_auth").(string)
+		}
 		cli := cleanhttp.DefaultClient()
 		transport := cleanhttp.DefaultTransport()
 		transport.TLSClientConfig = &tls.Config{}
@@ -179,6 +191,9 @@ func configure(version string, p *schema.Provider) func(context.Context, *schema
 		} else {
 			cfg.APIKey = auth[0]
 		}
+		if proxyAuth != "" {
+			cfg.Proxy.APIKey = proxyAuth
+		}
 		gclient, err := gapi.New(d.Get("url").(string), cfg)
 		if err != nil {
 			return nil, diag.FromErr(err)