diff --git a/crates-tauri/yaak-app-client/src/grpc.rs b/crates-tauri/yaak-app-client/src/grpc.rs
index 379be919..4981c9e2 100644
--- a/crates-tauri/yaak-app-client/src/grpc.rs
+++ b/crates-tauri/yaak-app-client/src/grpc.rs
@@ -80,6 +80,7 @@ pub(crate) async fn build_metadata<R: Runtime>(
                         value: value.to_string(),
                     })
                     .collect(),
+                body: None,
             };
             let plugin_result = plugin_manager
                 .call_http_authentication(
diff --git a/crates-tauri/yaak-app-client/src/ws_ext.rs b/crates-tauri/yaak-app-client/src/ws_ext.rs
index 088c7ea1..b16d1bc3 100644
--- a/crates-tauri/yaak-app-client/src/ws_ext.rs
+++ b/crates-tauri/yaak-app-client/src/ws_ext.rs
@@ -251,6 +251,7 @@ pub async fn cmd_ws_connect<R: Runtime>(
                     .into_iter()
                     .map(|h| HttpHeader { name: h.name, value: h.value })
                     .collect(),
+                body: None,
             };
             let plugin_result = plugin_manager
                 .call_http_authentication(
diff --git a/crates/yaak-plugins/bindings/gen_events.ts b/crates/yaak-plugins/bindings/gen_events.ts
index abd4fac3..0dbd3212 100644
--- a/crates/yaak-plugins/bindings/gen_events.ts
+++ b/crates/yaak-plugins/bindings/gen_events.ts
@@ -16,7 +16,7 @@ export type CallHttpAuthenticationActionArgs = { contextId: string, values: { [k
 
 export type CallHttpAuthenticationActionRequest = { index: number, pluginRefId: string, args: CallHttpAuthenticationActionArgs, };
 
-export type CallHttpAuthenticationRequest = { contextId: string, values: { [key in string]?: JsonPrimitive }, method: string, url: string, headers: Array<HttpHeader>, };
+export type CallHttpAuthenticationRequest = { contextId: string, values: { [key in string]?: JsonPrimitive }, method: string, url: string, headers: Array<HttpHeader>, body: string | null, };
 
 export type CallHttpAuthenticationResponse = { 
 /**
diff --git a/crates/yaak-plugins/src/events.rs b/crates/yaak-plugins/src/events.rs
index 5c9fdbd1..5fd480e5 100644
--- a/crates/yaak-plugins/src/events.rs
+++ b/crates/yaak-plugins/src/events.rs
@@ -746,6 +746,7 @@ pub struct CallHttpAuthenticationRequest {
     pub method: String,
     pub url: String,
     pub headers: Vec<HttpHeader>,
+    pub body: Option<String>,
 }
 
 #[derive(Debug, Clone, Default, Serialize, Deserialize, TS)]
diff --git a/crates/yaak/src/send.rs b/crates/yaak/src/send.rs
index da8dcb00..7f00fbfe 100644
--- a/crates/yaak/src/send.rs
+++ b/crates/yaak/src/send.rs
@@ -41,6 +41,7 @@ use yaak_tls::find_client_certificate;
 const HTTP_EVENT_CHANNEL_CAPACITY: usize = 100;
 const REQUEST_BODY_CHUNK_SIZE: usize = 1024 * 1024;
 const RESPONSE_PROGRESS_UPDATE_INTERVAL_MS: u128 = 100;
+const MAX_AUTH_BODY_BYTES: usize = 10 * 1024 * 1024;
 
 #[derive(Debug, Error)]
 pub enum SendHttpRequestError {
@@ -1086,6 +1087,17 @@ pub async fn apply_plugin_authentication(
                         value: value.to_string(),
                     })
                     .collect(),
+                body: match &sendable_request.body {
+                    // Bodies above the cap are not passed to auth plugins. Copying
+                    // them across the plugin IPC is too expensive, and payloads that
+                    // large are usually uploads that signing schemes treat as
+                    // unsigned anyway. Streamed bodies (files, multipart) are never
+                    // passed for the same reason.
+                    Some(SendableBody::Bytes(bytes)) if bytes.len() <= MAX_AUTH_BODY_BYTES => {
+                        String::from_utf8(bytes.to_vec()).ok()
+                    }
+                    _ => None,
+                },
             };
             let plugin_result = plugin_manager
                 .call_http_authentication(plugin_context, authentication_type, req)
diff --git a/packages/plugin-runtime-types/src/bindings/gen_events.ts b/packages/plugin-runtime-types/src/bindings/gen_events.ts
index abd4fac3..0dbd3212 100644
--- a/packages/plugin-runtime-types/src/bindings/gen_events.ts
+++ b/packages/plugin-runtime-types/src/bindings/gen_events.ts
@@ -16,7 +16,7 @@ export type CallHttpAuthenticationActionArgs = { contextId: string, values: { [k
 
 export type CallHttpAuthenticationActionRequest = { index: number, pluginRefId: string, args: CallHttpAuthenticationActionArgs, };
 
-export type CallHttpAuthenticationRequest = { contextId: string, values: { [key in string]?: JsonPrimitive }, method: string, url: string, headers: Array<HttpHeader>, };
+export type CallHttpAuthenticationRequest = { contextId: string, values: { [key in string]?: JsonPrimitive }, method: string, url: string, headers: Array<HttpHeader>, body: string | null, };
 
 export type CallHttpAuthenticationResponse = { 
 /**
diff --git a/plugins/auth-aws/src/index.ts b/plugins/auth-aws/src/index.ts
index b21b0205..5d5560b6 100644
--- a/plugins/auth-aws/src/index.ts
+++ b/plugins/auth-aws/src/index.ts
@@ -65,6 +65,7 @@ export const plugin: PluginDefinition = {
           service: String(values.service || "sts"),
           region: values.region ? String(values.region) : undefined,
           headers,
+          body: args.body ?? undefined,
           doNotEncodePath: true,
         },
         {