diff --git a/ragna/deploy/__init__.py b/ragna/deploy/__init__.py
index cdb2ba44..02738821 100644
--- a/ragna/deploy/__init__.py
+++ b/ragna/deploy/__init__.py
@@ -4,13 +4,21 @@
     "DummyBasicAuth",
     "GithubOAuth",
     "InMemoryKeyValueStore",
+    "JhubAppsAuth",
     "JupyterhubServerProxyAuth",
     "KeyValueStore",
     "NoAuth",
     "RedisKeyValueStore",
 ]
 
-from ._auth import Auth, DummyBasicAuth, GithubOAuth, JupyterhubServerProxyAuth, NoAuth
+from ._auth import (
+    Auth,
+    DummyBasicAuth,
+    GithubOAuth,
+    JhubAppsAuth,
+    JupyterhubServerProxyAuth,
+    NoAuth,
+)
 from ._config import Config
 from ._key_value_store import InMemoryKeyValueStore, KeyValueStore, RedisKeyValueStore
 
diff --git a/ragna/deploy/_auth.py b/ragna/deploy/_auth.py
index e7a39b4d..756b1451 100644
--- a/ragna/deploy/_auth.py
+++ b/ragna/deploy/_auth.py
@@ -404,3 +404,17 @@ def __init__(self) -> None:
 
     def login(self, request: Request) -> schemas.User:
         return self._user
+
+
+class JhubAppsAuth(_AutomaticLoginAuthBase):
+    async def login(self, request: Request) -> schemas.User:
+        assert "jhub_apps_access_token" in request.cookies
+        async with httpx.AsyncClient(
+            base_url=f"https://{request.url.netloc}",
+            cookies=request.cookies,
+        ) as client:
+            response = await client.get("/services/japps/user")
+            assert response.is_success
+
+            user_data = response.json()
+            return schemas.User(name=user_data.pop("name"), data=user_data)