diff --git a/auth/options.go b/auth/options.go
index 11010361..5ba08fe5 100644
--- a/auth/options.go
+++ b/auth/options.go
@@ -16,6 +16,8 @@ type Options struct {
 	Token *Token
 	// PublicKey for decoding JWTs
 	PublicKey string
+	// PrivateKey for encoding JWTs
+	PrivateKey string
 	// Provider is an auth provider
 	Provider provider.Provider
 	// LoginURL is the relative url path where a user can login
@@ -40,6 +42,13 @@ func PublicKey(key string) Option {
 	}
 }
 
+// PrivateKey is the JWT private key
+func PrivateKey(key string) Option {
+	return func(o *Options) {
+		o.PrivateKey = key
+	}
+}
+
 // Credentials sets the auth credentials
 func Credentials(id, secret string) Option {
 	return func(o *Options) {
diff --git a/config/cmd/cmd.go b/config/cmd/cmd.go
index c984391b..7b90b29a 100644
--- a/config/cmd/cmd.go
+++ b/config/cmd/cmd.go
@@ -670,6 +670,9 @@ func (c *cmd) Before(ctx *cli.Context) error {
 	if len(ctx.String("auth_public_key")) > 0 {
 		authOpts = append(authOpts, auth.PublicKey(ctx.String("auth_public_key")))
 	}
+	if len(ctx.String("auth_private_key")) > 0 {
+		authOpts = append(authOpts, auth.PrivateKey(ctx.String("auth_private_key")))
+	}
 
 	if name := ctx.String("auth_provider"); len(name) > 0 {
 		p, ok := DefaultAuthProviders[name]