diff --git a/src/management/wrapper/token-provider.ts b/src/management/wrapper/token-provider.ts
index a00cddd24a..dc5f76d620 100644
--- a/src/management/wrapper/token-provider.ts
+++ b/src/management/wrapper/token-provider.ts
@@ -16,7 +16,10 @@ export class TokenProvider {
     constructor(
         private readonly options: ManagementClient.ManagementClientOptionsWithClientCredentials & { audience: string },
     ) {
-        this.authenticationClient = new AuthenticationClient({ ...options, headers: undefined });
+        this.authenticationClient = new AuthenticationClient({
+            ...options,
+            headers: options.headers as Record<string, string>,
+        });
     }
 
     public async getAccessToken() {
diff --git a/tests/management/token-provider.test.ts b/tests/management/token-provider.test.ts
index 0e2cebd50d..ff5863eb41 100644
--- a/tests/management/token-provider.test.ts
+++ b/tests/management/token-provider.test.ts
@@ -122,6 +122,28 @@ describe("TokenProvider", () => {
         expect(spy).toHaveBeenCalledTimes(1);
     });
 
+    it("should forward plain string headers to the token fetch request", async () => {
+        const domain = "headers-test.auth0.com";
+        const customUserAgent = "my-custom-sdk/1.0";
+
+        const headerSpy = jest.fn().mockReturnValue({
+            access_token: "my-access-token",
+            expires_in: 86400,
+            token_type: "Bearer",
+        });
+
+        nock(`https://${domain}`).post("/oauth/token").matchHeader("user-agent", customUserAgent).reply(200, headerSpy);
+
+        const tp = new TokenProvider({
+            ...opts,
+            domain,
+            headers: { "User-Agent": customUserAgent },
+        });
+
+        expect(await tp.getAccessToken()).toBe("my-access-token");
+        expect(headerSpy).toHaveBeenCalled();
+    });
+
     it.skip("should use a custom fetch", async () => {
         const customFetch = jest
             .fn<FetchAPI>()