diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 4bac9be..edbd011 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -48,3 +48,37 @@ jobs:
         run: |
           echo "Resolved version: ${{ steps.setup.outputs.version }}"
           test -n "${{ steps.setup.outputs.version }}"
+
+  test-token:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install with token
+        uses: ./
+        with:
+          token: "test-token-value"
+
+      - name: Verify TESSL_TOKEN is set
+        run: |
+          if [ -z "$TESSL_TOKEN" ]; then
+            echo "::error::TESSL_TOKEN is not set"
+            exit 1
+          fi
+          echo "TESSL_TOKEN is set"
+
+  test-no-token:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install without token
+        uses: ./
+
+      - name: Verify TESSL_TOKEN is not set
+        run: |
+          if [ -n "$TESSL_TOKEN" ]; then
+            echo "::error::TESSL_TOKEN should not be set when no token is provided"
+            exit 1
+          fi
+          echo "TESSL_TOKEN is correctly unset"
diff --git a/README.md b/README.md
index 35ac9fc..0331803 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,6 @@
 # setup-tessl
 
-A GitHub Action to install the [Tessl](https://tessl.io) CLI in your workflows.
+A GitHub Action to install the [Tessl](https://tessl.io) CLI in your workflows. Optionally configure authentication so subsequent steps can run authenticated commands.
 
 ## Usage
 
@@ -16,11 +16,30 @@ Or pin a specific version:
     version: "0.73.0"
 ```
 
+### Authenticated usage
+
+Pass an API token as `token` to make it available as `TESSL_TOKEN` for every subsequent step in the job. Store the token as a [repository or organization secret](https://docs.github.com/en/actions/security-for-github-actions/security-guides/using-secrets-in-github-actions) and reference it with `${{ secrets.TESSL_TOKEN }}`.
+
+API tokens can be created in your workspace settings.
+
+```yaml
+- uses: tesslio/setup-tessl@v1
+  with:
+    token: ${{ secrets.TESSL_TOKEN }}
+```
+
+Once configured, all later steps in the same job can call the Tessl CLI as authenticated without any extra setup:
+
+```yaml
+- run: tessl publish
+```
+
 ## Inputs
 
-| Input     | Required | Default    | Description                                    |
-|-----------|----------|------------|------------------------------------------------|
-| `version` | No       | `"latest"` | Tessl CLI version to install, or `"latest"`   |
+| Input     | Required | Default    | Description                                                        |
+|-----------|----------|------------|--------------------------------------------------------------------|
+| `version` | No       | `"latest"` | Tessl CLI version to install, or `"latest"`                       |
+| `token`   | No       | —          | Tessl API token. When set, exported as `TESSL_TOKEN` for all subsequent steps. |
 
 ## Outputs
 
@@ -40,7 +59,9 @@ Or pin a specific version:
 | `macos-latest`    | `darwin-arm64`   |
 | `macos-13`        | `darwin-x64`     |
 
-## Example
+## Examples
+
+### Code review on pull requests
 
 ```yaml
 name: Review
@@ -52,9 +73,20 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - uses: tesslio/setup-tessl@v1
+        with:
+          token: ${{ secrets.TESSL_TOKEN }}
       - run: tessl review
 ```
 
+### Pin a CLI version
+
+```yaml
+- uses: tesslio/setup-tessl@v1
+  with:
+    version: "0.73.0"
+    token: ${{ secrets.TESSL_TOKEN }}
+```
+
 ## License
 
 MIT
diff --git a/action.yml b/action.yml
index 27121dd..181c5d9 100644
--- a/action.yml
+++ b/action.yml
@@ -10,6 +10,9 @@ inputs:
     description: Tessl CLI version to install (e.g. "0.73.0", or "latest")
     required: false
     default: "latest"
+  token:
+    description: Tessl API token for authentication. When set, exported as TESSL_TOKEN for all subsequent steps.
+    required: false
 
 outputs:
   version:
@@ -97,3 +100,12 @@ runs:
       run: |
         echo "Verifying tessl installation..."
         tessl --version
+
+    - name: Configure authentication
+      if: ${{ inputs.token != '' }}
+      shell: bash
+      env:
+        TESSL_TOKEN: ${{ inputs.token }}
+      run: |
+        echo "::add-mask::${TESSL_TOKEN}"
+        echo "TESSL_TOKEN=${TESSL_TOKEN}" >> "$GITHUB_ENV"