diff --git a/client/__tests__/SettingsPage.test.tsx b/client/__tests__/SettingsPage.test.tsx
index 36d4252c..8f2d2251 100644
--- a/client/__tests__/SettingsPage.test.tsx
+++ b/client/__tests__/SettingsPage.test.tsx
@@ -332,6 +332,8 @@ describe("SettingsPage", () => {
         apiUrl: "http://apprise:8000",
         key: "",
         urls: "discord://webhook/xyz",
+        username: "",
+        password: "",
       });
     });
   });
diff --git a/client/src/pages/settings.tsx b/client/src/pages/settings.tsx
index b25f1de5..abcb197a 100644
--- a/client/src/pages/settings.tsx
+++ b/client/src/pages/settings.tsx
@@ -102,6 +102,14 @@ const NOTIFICATION_EVENT_ROWS: { key: NotificationEvent; label: string; group: s
   { key: "errorDetected", label: "Error Detected", group: "system" },
 ];
 
+function isHttpUrl(value: string): boolean {
+  try {
+    return new URL(value.trim()).protocol === "http:";
+  } catch {
+    return false;
+  }
+}
+
 function SettingsToggleRow({
   id,
   label,
@@ -374,6 +382,8 @@ export default function SettingsPage() {
   const [appriseApiUrl, setAppriseApiUrl] = useState("");
   const [appriseKey, setAppriseKey] = useState("");
   const [appriseUrls, setAppriseUrls] = useState("");
+  const [appriseUsername, setAppriseUsername] = useState("");
+  const [apprisePassword, setApprisePassword] = useState("");
   const appriseLoadedRef = useRef(false);
   const settingsLoadedRef = useRef(false);
 
@@ -531,6 +541,8 @@ export default function SettingsPage() {
     apiUrl: string | null;
     key: string | null;
     urls: string | null;
+    username?: string;
+    password?: string;
   }>({
     queryKey: ["/api/settings/apprise"],
     queryFn: () => apiRequest("GET", "/api/settings/apprise").then((r) => r.json()),
@@ -542,6 +554,8 @@ export default function SettingsPage() {
       if (appriseSettings.apiUrl !== undefined) setAppriseApiUrl(appriseSettings.apiUrl ?? "");
       if (appriseSettings.key !== undefined) setAppriseKey(appriseSettings.key ?? "");
       if (appriseSettings.urls !== undefined) setAppriseUrls(appriseSettings.urls ?? "");
+      setAppriseUsername(appriseSettings.username ?? "");
+      setApprisePassword(appriseSettings.password ?? "");
       appriseLoadedRef.current = true;
     }
   }, [appriseSettings]);
@@ -560,6 +574,8 @@ export default function SettingsPage() {
       apiUrl?: string;
       key?: string;
       urls?: string;
+      username?: string;
+      password?: string;
     }) => {
       const res = await apiRequest("POST", "/api/settings/apprise", data);
       return res.json();
@@ -1655,6 +1671,50 @@ export default function SettingsPage() {
                     </p>
                   </div>
                 )}
+                {appriseMode === "api" && (
+                  <div className="grid gap-4 sm:grid-cols-2">
+                    <div className="space-y-2">
+                      <Label htmlFor="apprise-username">
+                        Username{" "}
+                        <span className="text-xs text-muted-foreground font-normal">
+                          (optional)
+                        </span>
+                      </Label>
+                      <Input
+                        id="apprise-username"
+                        type="text"
+                        autoComplete="off"
+                        value={appriseUsername}
+                        onChange={(e) => setAppriseUsername(e.target.value)}
+                      />
+                    </div>
+                    <div className="space-y-2">
+                      <Label htmlFor="apprise-password">
+                        Password{" "}
+                        <span className="text-xs text-muted-foreground font-normal">
+                          (optional)
+                        </span>
+                      </Label>
+                      <Input
+                        id="apprise-password"
+                        type="password"
+                        autoComplete="new-password"
+                        value={apprisePassword}
+                        onChange={(e) => setApprisePassword(e.target.value)}
+                      />
+                    </div>
+                    <p className="text-xs text-muted-foreground sm:col-span-2">
+                      Only needed when your Apprise API server requires a login:{" "}
+                      <code className="px-1">APPRISE_AUTH_REQUIRED=yes</code>.
+                    </p>
+                    {(appriseUsername.trim() || apprisePassword) && isHttpUrl(appriseApiUrl) && (
+                      <p className="text-xs text-amber-700 in-[.dark]:text-amber-500 sm:col-span-2">
+                        This API URL uses http://, so the login is sent unencrypted. Use https://
+                        unless Apprise runs on a network you trust.
+                      </p>
+                    )}
+                  </div>
+                )}
                 <div className="space-y-2">
                   <Label htmlFor="apprise-urls">
                     Notification URLs{" "}
@@ -1694,6 +1754,8 @@ export default function SettingsPage() {
                               apiUrl: appriseApiUrl.trim(),
                               key: appriseKey.trim(),
                               urls: appriseUrls.trim(),
+                              username: appriseUsername.trim(),
+                              password: apprisePassword,
                             }
                       )
                     }
diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md
index 1294ef5d..c73a0244 100644
--- a/docs/CHANGELOG.md
+++ b/docs/CHANGELOG.md
@@ -42,6 +42,7 @@ All notable changes to this project will be documented in this file.
 - **PostgreSQL backend**: [OPTIONAL] Questarr can now run on PostgreSQL instead of SQLite, selected with `DB_DIALECT=postgres` plus `DATABASE_URL` (setting `DATABASE_URL` alone keeps SQLite) (#1046). See `docs/DATABASE.md` if you're looking to migrate from SQLite.
 - **Playnite integration**: API keys, an integration API, and a Playnite extension. See [the extension's README](https://github.com/Doezer/Questarr/blob/main/extensions/playnite-questarr/README.md) for setup (#986).
 - **Steam wishlist**: optional auto-sync on a configurable interval, alongside the existing manual sync (#805).
+- **Apprise API login**: Questarr can send a username and password to an Apprise API server that requires a login (`APPRISE_AUTH_REQUIRED=yes`, Apprise API 2). The password is stored encrypted.
 
 #### Deployment & Admin
 
diff --git a/server/__tests__/api_routes.test.ts b/server/__tests__/api_routes.test.ts
index f7b75f46..76e5cb03 100644
--- a/server/__tests__/api_routes.test.ts
+++ b/server/__tests__/api_routes.test.ts
@@ -41,7 +41,8 @@ import { rssService } from "../rss.js";
 import { comparePassword } from "../auth.js";
 import { routesLogger } from "../logger.js";
 import { db } from "../db.js";
-import { appriseClient } from "../apprise.js";
+import { appriseClient, readAppriseSettings } from "../apprise.js";
+import { decryptCredential } from "../credential-crypto.js";
 import * as ssrfModule from "../ssrf.js";
 import fsExtra from "fs-extra";
 import { normalizeTitle } from "../../shared/title-utils.js";
@@ -140,6 +141,16 @@ vi.mock("../middleware.js", async () => {
 });
 
 vi.mock("../config.js", () => ({ config: mockConfig }));
+// The real encryptCredential would load its key through the mocked db module.
+vi.mock("../credential-crypto.js", async () => {
+  const actual =
+    await vi.importActual<typeof import("../credential-crypto.js")>("../credential-crypto.js");
+  return {
+    ...actual,
+    encryptCredential: vi.fn(async (value: string) => `enc:v1:${value}`),
+    decryptCredential: vi.fn(async (value: string) => value),
+  };
+});
 vi.mock("../config-loader.js", () => ({ configLoader: createConfigLoaderMock() }));
 vi.mock("../socket.js", () => createSocketMock());
 
@@ -3945,6 +3956,74 @@ describe("API Routes - Extended Coverage", () => {
       expect(appriseState["apprise.mode"]).toBe("cli");
     });
 
+    it("should mask a saved API password and return the username", async () => {
+      appriseState["apprise.username"] = "admin";
+      appriseState["apprise.password"] = "secret";
+
+      const response = await request(app).get("/api/settings/apprise");
+
+      expect(response.status).toBe(200);
+      expect(response.body.username).toBe("admin");
+      expect(response.body.password).toBe("********");
+    });
+
+    it("should store API credentials encrypted and keep the password on a masked resubmit", async () => {
+      const response = await request(app).post("/api/settings/apprise").send({
+        mode: "api",
+        apiUrl: "http://apprise:8000",
+        key: "config-key",
+        username: " admin ",
+        password: "secret",
+      });
+
+      expect(response.status).toBe(200);
+      expect(appriseState["apprise.username"]).toBe("admin");
+      expect(appriseState["apprise.password"]).toBe("enc:v1:secret");
+
+      const resubmit = await request(app).post("/api/settings/apprise").send({
+        mode: "api",
+        apiUrl: "http://apprise:8000",
+        key: "config-key",
+        username: "admin",
+        password: "********",
+      });
+
+      expect(resubmit.status).toBe(200);
+      expect(appriseState["apprise.password"]).toBe("enc:v1:secret");
+    });
+
+    it("should not decrypt the API password in CLI mode", async () => {
+      appriseState["apprise.mode"] = "cli";
+      appriseState["apprise.password"] = "enc:v1:secret";
+      vi.mocked(decryptCredential).mockClear();
+
+      const settings = await readAppriseSettings(storage);
+
+      expect(settings.password).toBeNull();
+      expect(decryptCredential).not.toHaveBeenCalled();
+    });
+
+    it("should still report a saved API password while CLI mode is active", async () => {
+      appriseState["apprise.mode"] = "cli";
+      appriseState["apprise.password"] = "enc:v1:secret";
+
+      const response = await request(app).get("/api/settings/apprise");
+
+      expect(response.status).toBe(200);
+      expect(response.body.password).toBe("********");
+    });
+
+    it("should reject a username containing a colon", async () => {
+      const response = await request(app).post("/api/settings/apprise").send({
+        mode: "api",
+        apiUrl: "http://apprise:8000",
+        key: "config-key",
+        username: "ad:min",
+      });
+
+      expect(response.status).toBe(400);
+    });
+
     it("should reject an invalid mode", async () => {
       const response = await request(app)
         .post("/api/settings/apprise")
diff --git a/server/__tests__/apprise.test.ts b/server/__tests__/apprise.test.ts
index bdd46e32..0f13583c 100644
--- a/server/__tests__/apprise.test.ts
+++ b/server/__tests__/apprise.test.ts
@@ -85,6 +85,63 @@ describe("Apprise client", () => {
     );
   });
 
+  it("sends HTTP Basic Auth credentials to a protected Apprise API server", async () => {
+    vi.mocked(safeFetch).mockResolvedValue({
+      ok: true,
+      status: 200,
+      text: vi.fn().mockResolvedValue(""),
+    } as never);
+
+    appriseClient.configure({
+      mode: "api",
+      apiUrl: "http://apprise:8000",
+      key: "config-key",
+      urls: null,
+      username: "admin",
+      password: "s3cret:pass",
+    });
+
+    await expect(appriseClient.test()).resolves.toEqual({ success: true });
+    expect(safeFetch).toHaveBeenCalledWith(
+      "http://apprise:8000/notify/config-key",
+      expect.objectContaining({
+        requireHttps: false,
+        headers: {
+          "Content-Type": "application/json",
+          Authorization: `Basic ${Buffer.from("admin:s3cret:pass").toString("base64")}`,
+        },
+      })
+    );
+  });
+
+  it("refuses to let credentials sent to an https server be redirected to http", async () => {
+    vi.mocked(safeFetch).mockResolvedValue({
+      ok: true,
+      status: 200,
+      text: vi.fn().mockResolvedValue(""),
+    } as never);
+
+    appriseClient.configure({
+      mode: "api",
+      apiUrl: "HTTPS://apprise.example.com",
+      key: "config-key",
+      urls: null,
+      username: "admin",
+      password: "secret",
+    });
+
+    await appriseClient.send(notification);
+    expect(safeFetch).toHaveBeenCalledWith(
+      "HTTPS://apprise.example.com/notify/config-key",
+      expect.objectContaining({
+        requireHttps: true,
+        headers: expect.objectContaining({
+          Authorization: `Basic ${Buffer.from("admin:secret").toString("base64")}`,
+        }),
+      })
+    );
+  });
+
   it("sends notifications via Apprise CLI mode using a config file, not argv URLs", async () => {
     let capturedArgs: string[] = [];
     let capturedConfigContent = "";
diff --git a/server/apprise.ts b/server/apprise.ts
index 3e03330f..b81af4be 100644
--- a/server/apprise.ts
+++ b/server/apprise.ts
@@ -25,6 +25,10 @@ export interface AppriseSettings {
   apiUrl: string | null;
   key: string | null;
   urls: string | null;
+  // HTTP Basic Auth credentials for an Apprise API server started with
+  // APPRISE_AUTH_REQUIRED=yes (API mode only; the username may be empty).
+  username: string | null;
+  password: string | null;
 }
 
 type ExecFileResult = { stdout: string; stderr: string };
@@ -117,21 +121,49 @@ export function isAppriseConfigured(settings: AppriseSettings): boolean {
 export async function readAppriseSettings(storage: {
   getSystemConfig(key: string): Promise<string | undefined>;
 }): Promise<AppriseSettings> {
-  const [mode, apiUrl, key, urls] = await Promise.all([
+  const [mode, apiUrl, key, urls, username, password] = await Promise.all([
     storage.getSystemConfig("apprise.mode"),
     storage.getSystemConfig("apprise.apiUrl"),
     storage.getSystemConfig("apprise.key"),
     storage.getSystemConfig("apprise.urls"),
+    storage.getSystemConfig("apprise.username"),
+    storage.getSystemConfig("apprise.password"),
   ]);
 
+  const normalizedMode = normalizeAppriseMode(mode);
   return {
-    mode: normalizeAppriseMode(mode),
+    mode: normalizedMode,
     apiUrl: trimToNull(apiUrl),
     key: trimToNull(key),
     urls: trimToNull(urls),
+    username: trimToNull(username),
+    // CLI mode never uses the API password, so a value that no longer decrypts must not block it.
+    password: normalizedMode === "api" ? await readApiPassword(password) : null,
   };
 }
 
+async function readApiPassword(stored: string | undefined): Promise<string | null> {
+  if (!stored) return null;
+  try {
+    // Loaded lazily: credential-crypto pulls in the database module, which modules that
+    // only send notifications through appriseClient should not have to initialize.
+    const { decryptCredential } = await import("./credential-crypto.js");
+    return (await decryptCredential(stored)) || null;
+  } catch (error) {
+    appriseLogger.warn({ error }, "Could not decrypt the saved Apprise API password");
+    return null;
+  }
+}
+
+function isHttpsUrl(value: string | null): boolean {
+  if (!value) return false;
+  try {
+    return new URL(value).protocol === "https:";
+  } catch {
+    return false;
+  }
+}
+
 function formatCliError(error: unknown, stdout = "", stderr = ""): string {
   const execError = error as ExecFileError | undefined;
   if (execError?.code === "ENOENT") {
@@ -200,6 +232,8 @@ class AppriseClient {
     apiUrl: null,
     key: null,
     urls: null,
+    username: null,
+    password: null,
   };
 
   configure(settings: Partial<AppriseSettings>): void {
@@ -208,6 +242,8 @@ class AppriseClient {
       apiUrl: trimToNull(settings.apiUrl),
       key: trimToNull(settings.key),
       urls: trimToNull(settings.urls),
+      username: trimToNull(settings.username),
+      password: settings.password || null,
     };
   }
 
@@ -219,6 +255,25 @@ class AppriseClient {
     return isAppriseConfigured(this.settings);
   }
 
+  private buildApiHeaders(): Record<string, string> {
+    const headers: Record<string, string> = { "Content-Type": "application/json" };
+    if (this.hasApiCredentials()) {
+      const credentials = `${this.settings.username ?? ""}:${this.settings.password ?? ""}`;
+      headers.Authorization = `Basic ${Buffer.from(credentials, "utf8").toString("base64")}`;
+    }
+    return headers;
+  }
+
+  private hasApiCredentials(): boolean {
+    return !!(this.settings.username || this.settings.password);
+  }
+
+  // Once credentials are configured against an https:// server, never let a redirect
+  // downgrade the request (and its Authorization header) to plaintext http.
+  private requiresHttps(): boolean {
+    return this.hasApiCredentials() && isHttpsUrl(this.settings.apiUrl);
+  }
+
   private buildApiRequest(
     title: string,
     message: string,
@@ -257,7 +312,8 @@ class AppriseClient {
       const res = await safeFetch(request.endpoint, {
         method: "POST",
         allowPrivate: true,
-        headers: { "Content-Type": "application/json" },
+        requireHttps: this.requiresHttps(),
+        headers: this.buildApiHeaders(),
         body: JSON.stringify(request.payload),
       });
 
@@ -347,7 +403,8 @@ class AppriseClient {
       const res = await safeFetch(request.endpoint, {
         method: "POST",
         allowPrivate: true,
-        headers: { "Content-Type": "application/json" },
+        requireHttps: this.requiresHttps(),
+        headers: this.buildApiHeaders(),
         body: JSON.stringify(request.payload),
       });
 
diff --git a/server/routes.ts b/server/routes.ts
index b8c50aec..1470511c 100644
--- a/server/routes.ts
+++ b/server/routes.ts
@@ -4808,6 +4808,10 @@ export async function registerRoutes(app: Express): Promise<Server> {
         apiUrl: settings.apiUrl,
         key: settings.key,
         urls: settings.urls,
+        username: settings.username ?? "",
+        // Based on the stored value, not the decrypted one: CLI mode never decrypts the
+        // password, and the masked field must still round-trip when switching back to API.
+        password: (await storage.getSystemConfig("apprise.password")) ? REDACTED_PLACEHOLDER : "",
       });
     } catch (error) {
       routesLogger.error({ error }, "Failed to fetch Apprise settings");
@@ -4817,11 +4821,13 @@ export async function registerRoutes(app: Express): Promise<Server> {
 
   app.post("/api/settings/apprise", async (req, res) => {
     try {
-      const { apiUrl, key, urls } = req.body as {
+      const { apiUrl, key, urls, username, password } = req.body as {
         mode?: string;
         apiUrl?: string;
         key?: string;
         urls?: string;
+        username?: string;
+        password?: string;
       };
       const mode = normalizeAppriseMode(
         typeof req.body?.mode === "string" ? req.body.mode : undefined
@@ -4838,11 +4844,18 @@ export async function registerRoutes(app: Express): Promise<Server> {
       if (
         (apiUrl !== undefined && typeof apiUrl !== "string") ||
         (key !== undefined && typeof key !== "string") ||
-        (urls !== undefined && typeof urls !== "string")
+        (urls !== undefined && typeof urls !== "string") ||
+        (username !== undefined && typeof username !== "string") ||
+        (password !== undefined && typeof password !== "string")
       ) {
         return res.status(400).json({ error: "Invalid request payload types" });
       }
 
+      // HTTP Basic Auth splits on the first colon, and apprise-api rejects one in APPRISE_USER.
+      if (username?.includes(":")) {
+        return res.status(400).json({ error: "Username cannot contain a colon" });
+      }
+
       if (mode === "api") {
         if (!apiUrl || apiUrl.trim().length === 0) {
           return res.status(400).json({ error: "API URL is required in API mode" });
@@ -4874,6 +4887,12 @@ export async function registerRoutes(app: Express): Promise<Server> {
       if (urls !== undefined) {
         await storage.setSystemConfig("apprise.urls", urls.trim());
       }
+      if (username !== undefined) {
+        await storage.setSystemConfig("apprise.username", username.trim());
+      }
+      if (password !== undefined && !isUnchangedSentinel(password)) {
+        await storage.setSystemConfig("apprise.password", await encryptCredential(password));
+      }
 
       appriseClient.configure(await readAppriseSettings(storage));
       return res.json({ success: true });