diff --git a/cmd/influx/global.go b/cmd/influx/global.go
index 234b2b3..656ebe6 100644
--- a/cmd/influx/global.go
+++ b/cmd/influx/global.go
@@ -17,15 +17,16 @@ import (
 )
 
 const (
-	tokenFlagName       = "token"
-	hostFlagName        = "host"
-	skipVerifyFlagName  = "skip-verify"
-	traceIdFlagName     = "trace-debug-id"
-	configPathFlagName  = "configs-path"
-	configNameFlagName  = "active-config"
-	httpDebugFlagName   = "http-debug"
-	printJsonFlagName   = "json"
-	hideHeadersFlagName = "hide-headers"
+	tokenFlagName           = "token"
+	hostFlagName            = "host"
+	skipVerifyFlagName      = "skip-verify"
+	traceIdFlagName         = "trace-debug-id"
+	extraHttpHeaderFlagName = "extra-http-header"
+	configPathFlagName      = "configs-path"
+	configNameFlagName      = "active-config"
+	httpDebugFlagName       = "http-debug"
+	printJsonFlagName       = "json"
+	hideHeadersFlagName     = "hide-headers"
 )
 
 // newCli builds a CLI core that reads from stdin, writes to stdout/stderr, manages a local config store,
@@ -91,7 +92,19 @@ func newApiClient(ctx *cli.Context, configSvc config.Service, injectToken bool)
 		configParams.TraceId = api.PtrString(ctx.String(traceIdFlagName))
 	}
 
-	return api.NewAPIClient(api.NewAPIConfig(configParams)), nil
+	apiConfig := api.NewAPIConfig(configParams)
+
+	if ctx.IsSet(extraHttpHeaderFlagName) {
+		for _, h := range ctx.StringSlice(extraHttpHeaderFlagName) {
+			k, v, ok := stringsCut(h, ":")
+			if !ok {
+				return nil, fmt.Errorf(`header flag syntax "key:value", missing value in %q`, h)
+			}
+			apiConfig.AddDefaultHeader(k, v)
+		}
+	}
+
+	return api.NewAPIClient(apiConfig), nil
 }
 
 func withContext() cli.BeforeFunc {
@@ -170,6 +183,10 @@ type CommonStringFlag struct {
 	cli.StringFlag
 }
 
+type CommonStringSliceFlag struct {
+	cli.StringSliceFlag
+}
+
 // NOTE: urfave/cli has dedicated support for global flags, but it only parses those flags
 // if they're specified before any command names. This is incompatible with the old influx
 // CLI, which repeatedly registered common flags on every "leaf" command, forcing the flags
@@ -212,6 +229,11 @@ func coreFlags() []cli.Flag {
 			Hidden: true,
 			EnvVar: "INFLUX_TRACE_DEBUG_ID",
 		}},
+		&CommonStringSliceFlag{cli.StringSliceFlag{
+			Name:   extraHttpHeaderFlagName,
+			Hidden: true,
+			EnvVar: "INFLUX_EXTRA_HTTP_HEADER",
+		}},
 		&CommonBoolFlag{cli.BoolFlag{
 			Name: httpDebugFlagName,
 		}},
diff --git a/cmd/influx/util.go b/cmd/influx/util.go
new file mode 100644
index 0000000..fb93ab0
--- /dev/null
+++ b/cmd/influx/util.go
@@ -0,0 +1,9 @@
+//go:build go1.18
+
+package main
+
+import "strings"
+
+func stringsCut(s, sep string) (before, after string, found bool) {
+	return strings.Cut(s, sep)
+}
diff --git a/cmd/influx/util_go117.go b/cmd/influx/util_go117.go
new file mode 100644
index 0000000..041dbc0
--- /dev/null
+++ b/cmd/influx/util_go117.go
@@ -0,0 +1,16 @@
+//go:build !go1.18
+
+// remove this backward compat shim once we either:
+// a) upgrade cross-builder docker image in https://github.com/influxdata/edge/
+// b) switch the CI system for this repo away from using cross-builder docker image.
+
+package main
+
+import "strings"
+
+func stringsCut(s, sep string) (before, after string, found bool) {
+	if i := strings.Index(s, sep); i >= 0 {
+		return s[:i], s[i+len(sep):], true
+	}
+	return s, "", false
+}