diff --git a/apache/README.org b/apache/README.org
index e7eda75..a8975e1 100644
--- a/apache/README.org
+++ b/apache/README.org
@@ -123,7 +123,7 @@ apache:
       .*: {$0.home,{,www.,pro.}mydomain,*.$0.hop}.org
 #+end_src
 
-** Domain mapping
+*** Domain mapping
 
 You can automatically assign a domain to services in relation
 =web-proxy= or =publish-dir= with services managed by this charm using
@@ -154,6 +154,25 @@ apache:
 Allows to distribute services to domains quite freely.
 
 
+** Adding basic authentication for password protected access
+
+Any service using relation =web-proxy= or =publish-dir= can assign a
+simple =Basic Auth= protection (which is safe and secure only on =https=):
+
+#+begin_src yaml
+myservice:
+  # ...
+  relations:
+    web-proxy:
+      apache:
+        domain: mydomain.org
+        creds:
+          # USER: PASSWORD 
+          foo: fooP4s5w0rd
+          bar: barP4s5w0rd
+#+end_src
+
+
 * SSH Tunnel
 
 On the server side, you can configure your compose file::