diff --git a/src/api.js b/src/api.js
index bbab680ce..1efb22caa 100644
--- a/src/api.js
+++ b/src/api.js
@@ -8,10 +8,12 @@
  * e.g. No cross domain requests without CORS.
  *
  * @param {string|TypedAray} source Either a url to a PDF is located or a
- * typed array already populated with data.
+ * typed array (Uint8Array) already populated with data.
+ * @param {Object} headers An object containing the http headers like this:
+ * { Authorization: "BASIC XXX" }.
  * @return {Promise} A promise that is resolved with {PDFDocumentProxy} object.
  */
-PDFJS.getDocument = function getDocument(source) {
+PDFJS.getDocument = function getDocument(source, headers) {
   var promise = new PDFJS.Promise();
   var transport = new WorkerTransport(promise);
   if (typeof source === 'string') {
@@ -29,7 +31,8 @@ PDFJS.getDocument = function getDocument(source) {
         error: function getPDFError(e) {
           promise.reject('Unexpected server response of ' +
             e.target.status + '.');
-        }
+        },
+        headers: headers
       },
       function getPDFLoad(data) {
         transport.sendData(data);
diff --git a/src/core.js b/src/core.js
index 6a5ec275c..99a8dd161 100644
--- a/src/core.js
+++ b/src/core.js
@@ -31,7 +31,19 @@ function getPdf(arg, callback) {
     params = { url: arg };
 
   var xhr = new XMLHttpRequest();
+
   xhr.open('GET', params.url);
+
+  var headers = params.headers;
+  if (headers) {
+    for (var property in headers) {
+      if (typeof headers[property] === 'undefined')
+        continue;
+
+      xhr.setRequestHeader(property, params.headers[property]);
+    }
+  }
+
   xhr.mozResponseType = xhr.responseType = 'arraybuffer';
   var protocol = params.url.indexOf(':') < 0 ? window.location.protocol :
     params.url.substring(0, params.url.indexOf(':') + 1);