diff --git a/app/flatpak-builtins-remote-add.c b/app/flatpak-builtins-remote-add.c
index df7e800c..0c013a2f 100644
--- a/app/flatpak-builtins-remote-add.c
+++ b/app/flatpak-builtins-remote-add.c
@@ -54,7 +54,7 @@ static char *opt_collection_id = NULL;
 static gboolean opt_from;
 static char **opt_gpg_import;
 static char *opt_authenticator_name = NULL;
-static char *opt_authenticator_options = NULL;
+static char **opt_authenticator_options = NULL;
 
 static GOptionEntry add_options[] = {
   { "if-not-exists", 0, 0, G_OPTION_ARG_NONE, &opt_if_not_exists, N_("Do nothing if the provided remote exists"), NULL },
@@ -78,7 +78,7 @@ static GOptionEntry common_options[] = {
   { "filter", 0, 0, G_OPTION_ARG_FILENAME, &opt_filter, N_("Set path to local filter FILE"), N_("FILE") },
   { "disable", 0, 0, G_OPTION_ARG_NONE, &opt_disable, N_("Disable the remote"), NULL },
   { "authenticator-name", 0, 0, G_OPTION_ARG_STRING, &opt_authenticator_name, N_("Name of authenticator"), N_("NAME") },
-  { "authenticator-options", 0, 0, G_OPTION_ARG_STRING, &opt_authenticator_options, N_("Authenticator options"), N_("OPTIONS") },
+  { "authenticator-option", 0, 0, G_OPTION_ARG_STRING_ARRAY, &opt_authenticator_options, N_("Authenticator option"), N_("KEY=VALUE") },
   { NULL }
 };
 
@@ -192,7 +192,18 @@ get_config_from_opts (GKeyFile *config,
     }
 
   if (opt_authenticator_options)
-    g_key_file_set_string (config, group, "xa.authenticator-options", opt_authenticator_options);
+    {
+      for (int i = 0; opt_authenticator_options[i] != NULL; i++)
+        {
+          g_auto(GStrv) split = g_strsplit (opt_authenticator_options[i], "=", 2);
+          g_autofree char *key = g_strdup_printf ("xa.authenticator-options.%s", split[0]);
+
+          if (split[1] == NULL && *split[1] == 0)
+            g_key_file_remove_key (config, group, key, NULL);
+          else
+            g_key_file_set_string (config, group, key, split[1]);
+        }
+    }
 
   return TRUE;
 }
@@ -366,18 +377,6 @@ flatpak_builtin_remote_add (int argc, char **argv,
   if (opt_authenticator_name && !g_dbus_is_name (opt_authenticator_name))
     return flatpak_fail (error, _("Invalid authenticator name %s"), opt_authenticator_name);
 
-  if (opt_authenticator_options)
-    {
-      g_autoptr(GVariant) v =
-        g_variant_parse (G_VARIANT_TYPE("a{sv}"), opt_authenticator_options, NULL, NULL, error);
-
-      if (v == NULL)
-        {
-          g_prefix_error (error, _("Invalid authenticator options: "));
-          return FALSE;
-        }
-    }
-
   if (!flatpak_dir_modify_remote (dir, remote_name, config, gpg_data, cancellable, error))
     return FALSE;
 
diff --git a/app/flatpak-builtins-remote-modify.c b/app/flatpak-builtins-remote-modify.c
index 8e9af62a..6538a6b5 100644
--- a/app/flatpak-builtins-remote-modify.c
+++ b/app/flatpak-builtins-remote-modify.c
@@ -54,7 +54,7 @@ static char *opt_default_branch;
 static char *opt_url;
 static char *opt_collection_id = NULL;
 static char *opt_authenticator_name = NULL;
-static char *opt_authenticator_options = NULL;
+static char **opt_authenticator_options = NULL;
 static char **opt_gpg_import;
 
 
@@ -85,7 +85,7 @@ static GOptionEntry common_options[] = {
   { "filter", 0, 0, G_OPTION_ARG_FILENAME, &opt_filter, N_("Set path to local filter FILE"), N_("FILE") },
   { "disable", 0, 0, G_OPTION_ARG_NONE, &opt_disable, N_("Disable the remote"), NULL },
   { "authenticator-name", 0, 0, G_OPTION_ARG_STRING, &opt_authenticator_name, N_("Name of authenticator"), N_("NAME") },
-  { "authenticator-options", 0, 0, G_OPTION_ARG_STRING, &opt_authenticator_options, N_("Authenticator options"), N_("OPTIONS") },
+  { "authenticator-option", 0, 0, G_OPTION_ARG_STRING_ARRAY, &opt_authenticator_options, N_("Authenticator options"), N_("KEY=VALUE") },
   { NULL }
 };
 
@@ -231,7 +231,16 @@ get_config_from_opts (FlatpakDir *dir, const char *remote_name, gboolean *change
 
   if (opt_authenticator_options)
     {
-      g_key_file_set_string (config, group, "xa.authenticator-options", opt_authenticator_options);
+      for (int i = 0; opt_authenticator_options[i] != NULL; i++)
+        {
+          g_auto(GStrv) split = g_strsplit (opt_authenticator_options[i], "=", 2);
+          g_autofree char *key = g_strdup_printf ("xa.authenticator-options.%s", split[0]);
+
+          if (split[0] == NULL ||split[1] == NULL || *split[1] == 0)
+            g_key_file_remove_key (config, group, key, NULL);
+          else
+            g_key_file_set_string (config, group, key, split[1]);
+        }
       *changed = TRUE;
     }
 
@@ -285,18 +294,6 @@ flatpak_builtin_remote_modify (int argc, char **argv, GCancellable *cancellable,
   if (opt_authenticator_name && !g_dbus_is_name (opt_authenticator_name))
     return flatpak_fail (error, _("Invalid authenticator name %s"), opt_authenticator_name);
 
-  if (opt_authenticator_options)
-    {
-      g_autoptr(GVariant) v =
-        g_variant_parse (G_VARIANT_TYPE("a{sv}"), opt_authenticator_options, NULL, NULL, error);
-
-      if (v == NULL)
-        {
-          g_prefix_error (error, _("Invalid authenticator options: "));
-          return FALSE;
-        }
-    }
-
   config = get_config_from_opts (preferred_dir, remote_name, &changed);
 
   if (opt_gpg_import != NULL)