diff --git a/caddyfile.go b/caddyfile.go
index b673f17..8bc9a91 100644
--- a/caddyfile.go
+++ b/caddyfile.go
@@ -121,6 +121,16 @@ func (h *Handler) UnmarshalCaddyfile(d *caddyfile.Dispenser) error {
 				h.ProbeResistance = &ProbeResistance{}
 			}
 
+		case "probe_resistance_auth_external":
+			args := d.RemainingArgs()
+			if len(args) != 0 {
+				return d.ArgErr()
+			}
+			if h.ProbeResistanceAuthExternal {
+				return d.Err("probe_resistance_auth_external specified twice")
+			}
+			h.ProbeResistanceAuthExternal = true
+
 		case "serve_pac":
 			args := d.RemainingArgs()
 			if len(args) > 1 {
diff --git a/forwardproxy.go b/forwardproxy.go
index f92fe25..badeee5 100644
--- a/forwardproxy.go
+++ b/forwardproxy.go
@@ -75,6 +75,11 @@ type Handler struct {
 	// Optional probe resistance. (See documentation.)
 	ProbeResistance *ProbeResistance `json:"probe_resistance,omitempty"`
 
+	// ProbeResistanceAuthExternal indicates that authentication for
+	// probe_resistance is handled externally (e.g., via forward_auth)
+	// and forwardproxy should not require its own auth_credentials.
+	ProbeResistanceAuthExternal bool `json:"probe_resistance_auth_external,omitempty"`
+
 	// How long to wait before timing out initial TCP connections.
 	DialTimeout caddy.Duration `json:"dial_timeout,omitempty"`
 
@@ -169,13 +174,14 @@ func (h *Handler) Provision(ctx caddy.Context) error {
 	}
 	h.aclRules = append(h.aclRules, &aclAllRule{allow: true})
 
-	if h.ProbeResistance != nil {
-		if h.AuthCredentials == nil {
-			return fmt.Errorf("probe resistance requires authentication")
-		}
-		if len(h.ProbeResistance.Domain) > 0 {
-			h.logger.Info("Secret domain used to connect to proxy: " + h.ProbeResistance.Domain)
-		}
+	if h.ProbeResistance != nil && h.AuthCredentials == nil && !h.ProbeResistanceAuthExternal {
+		return fmt.Errorf("probe resistance requires authentication")
+	}
+	if h.ProbeResistanceAuthExternal && h.AuthCredentials != nil {
+		return fmt.Errorf("probe_resistance_auth_external and auth_credentials are mutually exclusive")
+	}
+	if h.ProbeResistance != nil && len(h.ProbeResistance.Domain) > 0 {
+		h.logger.Info("Secret domain used to connect to proxy: " + h.ProbeResistance.Domain)
 	}
 
 	dialer := &net.Dialer{