diff --git a/Makefile b/Makefile
index cc2944b..8dbe79c 100644
--- a/Makefile
+++ b/Makefile
@@ -1,28 +1,28 @@
-	# Since we rely on paths relative to the makefile location, abort if make isn't being run from there.
+# Since we rely on paths relative to the makefile location, abort if make isn't being run from there.
 $(if $(findstring /,$(MAKEFILE_LIST)),$(error Please only invoke this makefile from the directory it resides in))
-	# Note: With Travis CI:
-	#  - the path to urchin is passed via the command line.
-	#  - the other utilities are NOT needed, so we skip the test for their existence.
+# Note: With Travis CI:
+#  - the path to urchin is passed via the command line.
+#  - the other utilities are NOT needed, so we skip the test for their existence.
 URCHIN := urchin
 ifeq ($(findstring /,$(URCHIN)),) # urchin path was NOT passed in.
-		# Add the local npm packages' bin folder to the PATH, so that `make` can find them, when invoked directly.
-		# Note that rather than using `$(npm bin)` the 'node_modules/.bin' path component is hard-coded, so that invocation works even from an environment
-		# where npm is (temporarily) unavailable due to having deactivated an nvm instance loaded into the calling shell in order to avoid interference with tests.
+	# Add the local npm packages' bin folder to the PATH, so that `make` can find them, when invoked directly.
+	# Note that rather than using `$(npm bin)` the 'node_modules/.bin' path component is hard-coded, so that invocation works even from an environment
+	# where npm is (temporarily) unavailable due to having deactivated an nvm instance loaded into the calling shell in order to avoid interference with tests.
 	export PATH := $(shell printf '%s' "$$PWD/node_modules/.bin:$$PATH")
-		# The list of all supporting utilities, installed with `npm install`.
+	# The list of all supporting utilities, installed with `npm install`.
 	UTILS := $(URCHIN) replace semver
-		# Make sure that all required utilities can be located.
+	# Make sure that all required utilities can be located.
 	UTIL_CHECK := $(or $(shell PATH="$(PATH)" which $(UTILS) >/dev/null && echo 'ok'),$(error Did you forget to run `npm install` after cloning the repo? At least one of the required supporting utilities not found: $(UTILS)))
 endif
-	# The files that need updating when incrementing the version number.
+# The files that need updating when incrementing the version number.
 VERSIONED_FILES := nvm.sh install.sh README.md package.json
-	# Define all shells to test with. Can be overridden with `make SHELLS=... <target>`.
+# Define all shells to test with. Can be overridden with `make SHELLS=... <target>`.
 SHELLS := sh bash dash zsh # ksh (#574)
-	# Generate 'test-<shell>' target names from specified shells.
-	# The embedded shell names are extracted on demand inside the recipes.
+# Generate 'test-<shell>' target names from specified shells.
+# The embedded shell names are extracted on demand inside the recipes.
 SHELL_TARGETS := $(addprefix test-,$(SHELLS))
-	# Define the default test suite(s). This can be overridden with `make TEST_SUITE=<...>  <target>`.
-	# Test suites are the names of subfolders of './test'.
+# Define the default test suite(s). This can be overridden with `make TEST_SUITE=<...>  <target>`.
+# Test suites are the names of subfolders of './test'.
 TEST_SUITE := $(shell find ./test/* -type d -prune -exec basename {} \;)
 
 
@@ -40,10 +40,14 @@ list:
 # Note that preexisting NVM_* variables are unset to avoid interfering with tests, except when running the Travis tests (where NVM_DIR must be passed in and the env. is assumed to be pristine).
 .PHONY: $(SHELL_TARGETS)
 $(SHELL_TARGETS):
-	@shell='$@'; shell=$${shell##*-}; which "$$shell" >/dev/null || { printf '\033[0;31m%s\033[0m\n' "WARNING: Cannot test with shell '$$shell': not found." >&2; exit 0; } && \
+	@shell='$@'; shell=$${shell##*-}; \
+	which "$$shell" >/dev/null || { printf '\033[0;31m%s\033[0m\n' "WARNING: Cannot test with shell '$$shell': not found." >&2; exit 0; } && \
 	printf '\n\033[0;34m%s\033[0m\n' "Running tests in $$shell"; \
 	[ -z "$$TRAVIS_BUILD_DIR" ] && for v in $$(set | awk -F'=' '$$1 ~ "^NVM_" { print $$1 }'); do unset $$v; done && unset v; \
-	for suite in $(TEST_SUITE); do $(URCHIN) -f -s $$shell test/$$suite || exit; done
+	for suite in $(TEST_SUITE); do \
+		echo "Running test suite: $$suite"; \
+		$(URCHIN) -f -s $$shell test/$$suite || exit; \
+	done
 
 # All-tests target: invokes the specified test suites for ALL shells defined in $(SHELLS).
 .PHONY: test
@@ -82,4 +86,4 @@ release: _ensure-tag _ensure-clean _ensure-current-version
 	printf "=== Bumping version **$$old_ver** to **$$new_ver** before committing and tagging:\n=== TYPE 'proceed' TO PROCEED, anything else to abort: " && read response && [ "$$response" = 'proceed' ] || { echo 'Aborted.' >&2; exit 2; }; \
 	replace "$$old_ver" "$$new_ver" $(VERSIONED_FILES) && \
 	git commit -m "v$$new_ver" $(VERSIONED_FILES) && \
-	git tag -a "v$$new_ver"
+	git tag -a "v$$new_ver"
\ No newline at end of file
diff --git a/README.md b/README.md
index cc021e6..a85cf5d 100644
--- a/README.md
+++ b/README.md
@@ -39,6 +39,7 @@
   - [Restoring PATH](#restoring-path)
   - [Set default node version](#set-default-node-version)
   - [Use a mirror of node binaries](#use-a-mirror-of-node-binaries)
+    - [Pass Authorization header to mirror](#pass-authorization-header-to-mirror)
   - [.nvmrc](#nvmrc)
   - [Deeper Shell Integration](#deeper-shell-integration)
     - [Calling `nvm use` automatically in a directory with a `.nvmrc` file](#calling-nvm-use-automatically-in-a-directory-with-a-nvmrc-file)
@@ -530,6 +531,17 @@ NVM_IOJS_ORG_MIRROR=https://iojs.org/dist nvm install iojs-v1.0.3
 
 `nvm use` will not, by default, create a "current" symlink. Set `$NVM_SYMLINK_CURRENT` to "true" to enable this behavior, which is sometimes useful for IDEs. Note that using `nvm` in multiple shell tabs with this environment variable enabled can cause race conditions.
 
+#### Pass Authorization header to mirror
+To pass an Authorization header through to the mirror url, set `$NVM_AUTH_HEADER`
+
+```sh
+export NVM_NODEJS_ORG_MIRROR=https://nodejs.org/dist
+export NVM_AUTH_HEADER="Bearer secret-token"
+nvm install node
+
+NVM_NODEJS_ORG_MIRROR=https://nodejs.org/dist NVM_AUTH_HEADER="Bearer secret-token" nvm install 4.2
+```
+
 ### .nvmrc
 
 You can create a `.nvmrc` file containing a node version number (or any other string that `nvm` understands; see `nvm --help` for details) in the project root directory (or any parent directory).
diff --git a/nvm.sh b/nvm.sh
index 6dc779e..3ccb7d8 100644
--- a/nvm.sh
+++ b/nvm.sh
@@ -116,12 +116,19 @@ nvm_get_latest() {
 }
 
 nvm_download() {
-  local CURL_COMPRESSED_FLAG
   if nvm_has "curl"; then
+    local CURL_COMPRESSED_FLAG=""
+    local CURL_HEADER_FLAG=""
+
+    if [ -n "${NVM_AUTH_HEADER:-}" ]; then
+      sanitized_header=$(nvm_sanitize_auth_header "${NVM_AUTH_HEADER}")
+      CURL_HEADER_FLAG="--header \"Authorization: ${sanitized_header}\""
+    fi
+
     if nvm_curl_use_compression; then
       CURL_COMPRESSED_FLAG="--compressed"
     fi
-    curl --fail ${CURL_COMPRESSED_FLAG:-} -q "$@"
+    eval "curl -q --fail ${CURL_COMPRESSED_FLAG:-} ${CURL_HEADER_FLAG:-} $*"
   elif nvm_has "wget"; then
     # Emulate curl with wget
     ARGS=$(nvm_echo "$@" | command sed -e 's/--progress-bar /--progress=bar /' \
@@ -133,11 +140,20 @@ nvm_download() {
                             -e 's/-sS /-nv /' \
                             -e 's/-o /-O /' \
                             -e 's/-C - /-c /')
+
+    if [ -n "${NVM_AUTH_HEADER:-}" ]; then
+      ARGS="${ARGS} --header \"${NVM_AUTH_HEADER}\""
+    fi
     # shellcheck disable=SC2086
     eval wget $ARGS
   fi
 }
 
+nvm_sanitize_auth_header() {
+    # Remove potentially dangerous characters
+    nvm_echo "$1" | command sed 's/[^a-zA-Z0-9:;_. -]//g'
+}
+
 nvm_has_system_node() {
   [ "$(nvm deactivate >/dev/null 2>&1 && command -v node)" != '' ]
 }
@@ -4357,7 +4373,7 @@ nvm() {
         nvm_sanitize_path nvm_has_colors nvm_process_parameters \
         nvm_node_version_has_solaris_binary nvm_iojs_version_has_solaris_binary \
         nvm_curl_libz_support nvm_command_info nvm_is_zsh nvm_stdout_is_terminal \
-        nvm_npmrc_bad_news_bears \
+        nvm_npmrc_bad_news_bears nvm_sanitize_auth_header \
         nvm_get_colors nvm_set_colors nvm_print_color_code nvm_wrap_with_color_code nvm_format_help_message_colors \
         nvm_echo_with_colors nvm_err_with_colors \
         nvm_get_artifact_compression nvm_install_binary_extract nvm_extract_tarball \
diff --git a/test/fast/Unit tests/nvm_download b/test/fast/Unit tests/nvm_download
index 3afd76c..19e2dd9 100644
--- a/test/fast/Unit tests/nvm_download	
+++ b/test/fast/Unit tests/nvm_download	
@@ -1,7 +1,8 @@
 #!/bin/sh
 
 cleanup () {
-  unset -f die cleanup
+  unset -f die cleanup NVM_AUTH_HEADER
+  docker stop httpbin && docker rm httpbin
 }
 die () { echo "$@" ; cleanup ; exit 1; }
 
@@ -15,4 +16,13 @@ nvm_download "https://raw.githubusercontent.com/nvm-sh/nvm/HEAD/install.sh" >/de
 # nvm_download should fail to download wrong_install.sh
 ! nvm_download "https://raw.githubusercontent.com/nvm-sh/nvm/HEAD/wrong_install.sh" >/dev/null || die "nvm_download should fail to download no existing file"
 
+# nvm_download should pass when calling with auth header
+docker pull kennethreitz/httpbin && docker run --shell=bash -d --name httpbin -p 80:80 kennethreitz/httpbin
+sleep 1 # wait for httpbin to start
+NVM_AUTH_HEADER="Bearer test-token" nvm_download "http://127.0.0.1/bearer" > /dev/null || die 'nvm_download with auth header should send correctly'
+
+# nvm_download should fail when calling without auth header
+nvm_download "http://127.0.0.1/bearer" > /dev/null && die 'nvm_download with no auth header should not send the header and should fail'
+docker stop httpbin && docker rm httpbin
+
 cleanup