diff --git a/README.md b/README.md
index e792066..b73e4a6 100644
--- a/README.md
+++ b/README.md
@@ -94,6 +94,7 @@ type is implemented in a way that you can pass your custom runtime image via con
 * `sources`: should point to an input retrieved via `get` or to an `output` from a previous step.
 * `config`: this section may contain any valid configuration which you would normally put in your
   `Pulumi.<stack>.yaml` file. Secrets are *not yet* supported.
+* `env`: this section may contain environment variables which are needed. E.g., for authentication
 
 Let's show this at work with an example of a NodeJS based Pulumi stack:
 
@@ -138,6 +139,15 @@ jobs:
       config:
         network:setting1: value1
         network:setting2: value2
+      env:
+        CLOUD_PROVIDER_CREDENTIALS: |
+          {
+            "private_key_id": "<private key id string>",
+            "private_key": "<private key string here>",
+            ...
+          }
+        CLOUD_PROVIDER_REGION: value1
+        CLOUD_PROVIDER_ZONE: value2
 ```
 
 The example task file:
@@ -228,6 +238,15 @@ jobs:
       config:
         network:setting1: value1
         network:setting2: value2
+      env:
+        CLOUD_PROVIDER_CREDENTIALS: |
+          {
+            "private_key_id": "<private key id string>",
+            "private_key": "<private key string here>",
+            ...
+          }
+        CLOUD_PROVIDER_REGION: value1
+        CLOUD_PROVIDER_ZONE: value2
 
 - name: after-update-infra
   plan:
diff --git a/pkg/models/out.go b/pkg/models/out.go
index 93b377f..a317f68 100644
--- a/pkg/models/out.go
+++ b/pkg/models/out.go
@@ -8,9 +8,10 @@ import (
 )
 
 type OutParams struct {
-	Sources string     `json:"sources"`
-	Runtime string     `json:"runtime"`
-	Config  config.Map `json:"config"`
+	Sources string            `json:"sources"`
+	Runtime string            `json:"runtime"`
+	Config  config.Map        `json:"config"`
+	Env     map[string]string `json:"env"`
 }
 
 // OutRequest is the struct representing the JSON coming in via stdin on `out` binary
diff --git a/pkg/models/out_test.go b/pkg/models/out_test.go
index 5d7c13c..3479354 100644
--- a/pkg/models/out_test.go
+++ b/pkg/models/out_test.go
@@ -117,3 +117,17 @@ func TestGetConfigMapStructuredConfig(t *testing.T) {
 	assert.NotEmpty(t, request.Params)
 	assert.Equal(t, expected, request.GetConfigMap())
 }
+func TestDecodeOutRequestWithEnvList(t *testing.T) {
+	jsonRequest := []byte("{ \"source\": " + source + ", \"params\": { \"env\": { \"VARIABLE_1\": \"value1\" , \"VARIABLE_2\": \"value2\"}}}")
+	request := OutRequest{}
+	if err := json.Unmarshal(jsonRequest, &request); err != nil {
+		assert.Fail(t, "Failed to unmarshal to OutRequest: %s", err)
+	}
+
+	expected := map[string]string{"VARIABLE_1": "value1", "VARIABLE_2": "value2"}
+
+	assert.NotNil(t, request)
+	assert.NotNil(t, request.Params)
+	assert.NotEmpty(t, request.Params)
+	assert.Equal(t, expected, request.Params.Env)
+}
diff --git a/pkg/out/out.go b/pkg/out/out.go
index d1b3e1b..2b738ee 100644
--- a/pkg/out/out.go
+++ b/pkg/out/out.go
@@ -35,16 +35,17 @@ func (r Runner) deployWithPulumi(req models.OutRequest) (models.OutResponse, err
 	ctx := context.Background()
 	projectName := req.Source.Project
 	stackName := auto.FullyQualifiedStackName(req.Source.Organization, projectName, req.Source.Stack)
+	envVars := req.Params.Env
+	// add common variables besides those specified in env map
+	envVars["PATH"] = req.ExtendPathWithRuntime(r.ConcourseBuildFolder, os.Getenv("PATH"))
+	envVars["PULUMI_ACCESS_TOKEN"] = req.Source.Token
 
 	// initialize a stack from the checked out sources
 	stack, err := auto.UpsertStackLocalSource(
 		ctx,
 		stackName,
 		req.GetSourceLocation(r.ConcourseBuildFolder),
-		auto.EnvVars(map[string]string{
-			"PULUMI_ACCESS_TOKEN": req.Source.Token,
-			"PATH":                req.ExtendPathWithRuntime(r.ConcourseBuildFolder, os.Getenv("PATH")),
-		}),
+		auto.EnvVars(envVars),
 	)
 	if err != nil {
 		return models.OutResponse{}, errors.Wrap(err, "Failed to create the stack")