diff --git a/NAMESPACE b/NAMESPACE
index c655457..bf0dac4 100644
--- a/NAMESPACE
+++ b/NAMESPACE
@@ -18,6 +18,7 @@ export(get_hydroseq)
 export(get_node)
 export(layer_exists)
 export(lynker_spatial_auth)
+export(lynker_spatial_url)
 export(node_geometry)
 export(read_hydrofabric)
 export(read_sf_dataset)
diff --git a/R/auth.R b/R/auth.R
index 6a9306c..5c08a95 100644
--- a/R/auth.R
+++ b/R/auth.R
@@ -5,9 +5,13 @@
 #' @param libs Supported libraries to configure auth for.
 #' @param duckdb_con A DuckDB DBI connection to add a bearer token secret to.
 #' @returns The `token` argument, or a newly provisioned token
+#'
+#' @details
+#' lynker_spatial.auth.token
+#' 
 #' @export
 lynker_spatial_auth <- function(
-  token = NULL,
+  token = getOption("lynker_spatial.token"),
   ...,
   libs = c("gdal", "duckdb"),
   duckdb_con = NULL
@@ -79,19 +83,26 @@ lynker_spatial_client <- function() {
 #' @keywords internal
 lynker_spatial_token <- function(..., client = lynker_spatial_client()) {
   # Get the token using the OIDC client
-  httr2::oauth_flow_auth_code(
+  token <- httr2::oauth_flow_auth_code(
     client,
     auth_url = client$provider$authorization_endpoint,
     scope = "openid profile email phone",
     redirect_uri = client$redirect_uri,
     pkce = TRUE
   )
+
+  options("lynker_spatial.token" = token)
+  token
 }
 
 #' Refresh an existing Lynker Spatial token
 #' @keywords internal
-lynker_spatial_refresh <- function(token, ..., client = lynker_spatial_client()) {
-  if (!inherits(token, "httr2_token")) {
+lynker_spatial_refresh <- function(token = getOption("lynker_spatial.token"), ..., client = lynker_spatial_client()) {
+  if (inherits(token, "httr2_token")) {
+    refresh_token <- token$refresh_token
+  } else if (is.character(token)) {
+    refresh_token <- token
+  } else {
     stop("token is malformed", call. = FALSE)
   }
 
diff --git a/man/lynker_spatial_auth.Rd b/man/lynker_spatial_auth.Rd
index bc3ae39..f8e9feb 100644
--- a/man/lynker_spatial_auth.Rd
+++ b/man/lynker_spatial_auth.Rd
@@ -5,7 +5,7 @@
 \title{Authenticate with Lynker Spatial}
 \usage{
 lynker_spatial_auth(
-  token = NULL,
+  token = getOption("lynker_spatial.token"),
   ...,
   libs = c("gdal", "duckdb"),
   duckdb_con = NULL
@@ -27,3 +27,6 @@ The `token` argument, or a newly provisioned token
 \description{
 Authenticate with Lynker Spatial
 }
+\details{
+lynker_spatial.auth.token
+}
diff --git a/man/lynker_spatial_refresh.Rd b/man/lynker_spatial_refresh.Rd
index 850acdb..2bf2517 100644
--- a/man/lynker_spatial_refresh.Rd
+++ b/man/lynker_spatial_refresh.Rd
@@ -4,7 +4,11 @@
 \alias{lynker_spatial_refresh}
 \title{Refresh an existing Lynker Spatial token}
 \usage{
-lynker_spatial_refresh(token, ..., client = lynker_spatial_client())
+lynker_spatial_refresh(
+  token = getOption("lynker_spatial.token"),
+  ...,
+  client = lynker_spatial_client()
+)
 }
 \description{
 Refresh an existing Lynker Spatial token
diff --git a/man/lynker_spatial_url.Rd b/man/lynker_spatial_url.Rd
new file mode 100644
index 0000000..9d4d90a
--- /dev/null
+++ b/man/lynker_spatial_url.Rd
@@ -0,0 +1,17 @@
+% Generated by roxygen2: do not edit by hand
+% Please edit documentation in R/auth.R
+\name{lynker_spatial_url}
+\alias{lynker_spatial_url}
+\title{Create an authenticated URL connection for Lynker Spatial}
+\usage{
+lynker_spatial_url(url)
+}
+\arguments{
+\item{url}{URL passed to the connection}
+}
+\value{
+a URL connection object
+}
+\description{
+Create an authenticated URL connection for Lynker Spatial
+}