diff --git a/common/flatpak-auth-private.h b/common/flatpak-auth-private.h
index 4f5476c6..fce34886 100644
--- a/common/flatpak-auth-private.h
+++ b/common/flatpak-auth-private.h
@@ -53,6 +53,7 @@ gboolean                     flatpak_auth_request_ref_tokens        (FlatpakAuth
                                                                      FlatpakAuthenticatorRequest  *request,
                                                                      const char                   *remote,
                                                                      GVariant                     *refs,
+                                                                     const char                   *parent_window,
                                                                      GCancellable                 *cancellable,
                                                                      GError                      **error);
 char *                       flatpak_auth_create_request_path       (const char                   *peer,
diff --git a/common/flatpak-auth.c b/common/flatpak-auth.c
index d8b93bcb..ac3c9632 100644
--- a/common/flatpak-auth.c
+++ b/common/flatpak-auth.c
@@ -131,6 +131,7 @@ flatpak_auth_request_ref_tokens (FlatpakAuthenticator *authenticator,
                                  FlatpakAuthenticatorRequest *request,
                                  const char *remote,
                                  GVariant *refs,
+                                 const char *parent_window,
                                  GCancellable *cancellable,
                                  GError **error)
 {
@@ -143,6 +144,7 @@ flatpak_auth_request_ref_tokens (FlatpakAuthenticator *authenticator,
   options = g_object_get_data (G_OBJECT (authenticator), "authenticator-options");
 
   if (!flatpak_authenticator_call_request_ref_tokens_sync (authenticator, token, options, remote, refs,
+                                                           parent_window ? parent_window : "",
                                                            &handle, cancellable, error))
     return FALSE;
 
diff --git a/common/flatpak-transaction.c b/common/flatpak-transaction.c
index ba43438a..920fea88 100644
--- a/common/flatpak-transaction.c
+++ b/common/flatpak-transaction.c
@@ -165,6 +165,7 @@ struct _FlatpakTransactionPrivate
 
   FlatpakTransactionOperation *current_op;
 
+  char                        *parent_window;
   gboolean                     no_pull;
   gboolean                     no_deploy;
   gboolean                     disable_static_deltas;
@@ -852,6 +853,7 @@ flatpak_transaction_finalize (GObject *object)
 
   g_clear_object (&priv->installation);
 
+  g_free (priv->parent_window);
   g_list_free_full (priv->flatpakrefs, (GDestroyNotify) g_key_file_unref);
   g_list_free_full (priv->bundles, (GDestroyNotify) bundle_data_free);
   g_free (priv->default_arch);
@@ -1288,6 +1290,55 @@ flatpak_transaction_get_no_pull (FlatpakTransaction *self)
   return priv->no_pull;
 }
 
+/**
+ * flatpak_transaction_set_parent_window:
+ * @self: a #FlatpakTransaction
+ * @parent_window: whether to avoid pulls
+ *
+ * Sets the parent window (if any) to use for any UI show by this transaction.
+ * This is used by authenticators if they need to interact with the user during
+ * authentication.
+ *
+ * The format of this string depends on the display system in use, and is the
+ * same as used by xdg-desktop-portal.
+ *
+ * On X11 it should be of the form x11:$xid where $xid is the hex
+ * version of the xwindows id.
+ *
+ * On wayland is should be wayland:$handle where handle is gotten by
+ * using the export call of the xdg-foreign-unstable wayland extension.
+ *
+ * Since: 1.5.1
+ */
+void
+flatpak_transaction_set_parent_window (FlatpakTransaction *self,
+                                       const char *parent_window)
+{
+  FlatpakTransactionPrivate *priv = flatpak_transaction_get_instance_private (self);
+
+  g_free (priv->parent_window);
+  priv->parent_window = g_strdup (parent_window);
+}
+
+/**
+ * flatpak_transaction_get_parent_window:
+ * @self: a #FlatpakTransaction
+ *
+ * Gets the parent window set for this transaction, or %NULL if unset. See
+ * flatpak_transaction_get_parent_window().
+ *
+ * Returns: (transfer none): a window name, or %NULL
+ *
+ * Since: 1.5.1
+ */
+const char *
+flatpak_transaction_get_parent_window (FlatpakTransaction *self)
+{
+  FlatpakTransactionPrivate *priv = flatpak_transaction_get_instance_private (self);
+
+  return priv->parent_window;
+}
+
 /**
  * flatpak_transaction_set_no_deploy:
  * @self: a #FlatpakTransaction
@@ -2815,7 +2866,7 @@ request_tokens_for_remote (FlatpakTransaction *self,
   priv->active_webflow = &data;
 
   data.request = request;
-  if (!flatpak_auth_request_ref_tokens (authenticator, request, remote, refs, cancellable, error))
+  if (!flatpak_auth_request_ref_tokens (authenticator, request, remote, refs, priv->parent_window, cancellable, error))
     return FALSE;
 
   while (!data.done)
diff --git a/common/flatpak-transaction.h b/common/flatpak-transaction.h
index bba67362..a62a2ab6 100644
--- a/common/flatpak-transaction.h
+++ b/common/flatpak-transaction.h
@@ -215,6 +215,11 @@ FLATPAK_EXTERN
 void                flatpak_transaction_set_default_arch (FlatpakTransaction *self,
                                                           const char         *arch);
 FLATPAK_EXTERN
+void                flatpak_transaction_set_parent_window (FlatpakTransaction *self,
+                                                           const char *parent_window);
+FLATPAK_EXTERN
+const char *        flatpak_transaction_get_parent_window (FlatpakTransaction *self);
+FLATPAK_EXTERN
 void                flatpak_transaction_add_dependency_source (FlatpakTransaction  *self,
                                                                FlatpakInstallation *installation);
 FLATPAK_EXTERN
diff --git a/data/org.freedesktop.Flatpak.xml b/data/org.freedesktop.Flatpak.xml
index 6ec7f8de..d302dec0 100644
--- a/data/org.freedesktop.Flatpak.xml
+++ b/data/org.freedesktop.Flatpak.xml
@@ -178,6 +178,7 @@
       <arg type='s' name='remote' direction='in'/>
       <!-- This is the ref and its token-type -->
       <arg type='a(si)' name='refs' direction='in'/>
+      <arg type='s' name='parent_window' direction='in'/>
       <arg type='o' name='handle' direction='out'/>
     </method>
   </interface>