diff --git a/pkg/kopia/command/const.go b/pkg/kopia/command/const.go
index f958a57e29..8cf3eec6b8 100644
--- a/pkg/kopia/command/const.go
+++ b/pkg/kopia/command/const.go
@@ -77,6 +77,7 @@ const (
 	userPasswordFlag          = "--user-password"
 	enablePprof               = "--enable-pprof"
 	metricsListerAddress      = "--metrics-listen-addr"
+	htpasswdFilePath          = "--htpasswd-file"
 
 	// Repository specific
 	repositorySubCommand      = "repository"
@@ -121,4 +122,7 @@ const (
 
 	// DefaultLogDirectory is the directory where kopia log file is created
 	DefaultLogDirectory = "/tmp/kopia-log"
+
+	// DefaultHtpasswdFilePath is the path to the generated htpasswd file
+	DefaultHtpasswdFilePath = "/tmp/kopia-htpasswd"
 )
diff --git a/pkg/kopia/command/server.go b/pkg/kopia/command/server.go
index da44a8cc48..10c9b1640c 100644
--- a/pkg/kopia/command/server.go
+++ b/pkg/kopia/command/server.go
@@ -25,6 +25,8 @@ type ServerStartCommandArgs struct {
 	TLSKeyFile           string
 	ServerUsername       string
 	ServerPassword       string
+	HtpasswdFilePath     string
+	ReadOnly             bool
 	AutoGenerateCert     bool
 	Background           bool
 	EnablePprof          bool
@@ -43,12 +45,21 @@ func ServerStart(cmdArgs ServerStartCommandArgs) []string {
 	args = args.AppendLoggableKV(addressFlag, cmdArgs.ServerAddress)
 	args = args.AppendLoggableKV(tlsCertFilePath, cmdArgs.TLSCertFile)
 	args = args.AppendLoggableKV(tlsKeyFilePath, cmdArgs.TLSKeyFile)
+
+	if cmdArgs.HtpasswdFilePath != "" {
+		args = args.AppendLoggableKV(htpasswdFilePath, cmdArgs.HtpasswdFilePath)
+	}
+
 	args = args.AppendLoggableKV(serverUsernameFlag, cmdArgs.ServerUsername)
 	args = args.AppendRedactedKV(serverPasswordFlag, cmdArgs.ServerPassword)
 
 	args = args.AppendLoggableKV(serverControlUsernameFlag, cmdArgs.ServerUsername)
 	args = args.AppendRedactedKV(serverControlPasswordFlag, cmdArgs.ServerPassword)
 
+	if cmdArgs.ReadOnly {
+		args = args.AppendLoggable(readOnlyFlag)
+	}
+
 	if cmdArgs.EnablePprof {
 		args = args.AppendLoggable(enablePprof)
 	}
diff --git a/pkg/kopia/command/server_test.go b/pkg/kopia/command/server_test.go
index 57e6517b29..349cd7651e 100644
--- a/pkg/kopia/command/server_test.go
+++ b/pkg/kopia/command/server_test.go
@@ -103,6 +103,24 @@ func (kServer *KopiaServerTestSuite) TestServerCommands(c *C) {
 			},
 			expectedLog: "bash -o errexit -c kopia --log-level=error --config-file=path/kopia.config --log-dir=cache/log server start --address=a-server-address --tls-cert-file=/path/to/cert/tls.crt --tls-key-file=/path/to/key/tls.key --server-username=a-username@a-hostname --server-password=a-user-password --server-control-username=a-username@a-hostname --server-control-password=a-user-password > /dev/null 2>&1 &",
 		},
+		{
+			f: func() []string {
+				args := ServerStartCommandArgs{
+					CommandArgs:      commandArgs,
+					ServerAddress:    "a-server-address",
+					TLSCertFile:      "/path/to/cert/tls.crt",
+					TLSKeyFile:       "/path/to/key/tls.key",
+					ServerUsername:   "a-username@a-hostname",
+					ServerPassword:   "a-user-password",
+					AutoGenerateCert: false,
+					Background:       true,
+					ReadOnly:         true,
+					HtpasswdFilePath: "/path/htpasswd",
+				}
+				return ServerStart(args)
+			},
+			expectedLog: "bash -o errexit -c kopia --log-level=error --config-file=path/kopia.config --log-dir=cache/log server start --address=a-server-address --tls-cert-file=/path/to/cert/tls.crt --tls-key-file=/path/to/key/tls.key --htpasswd-file=/path/htpasswd --server-username=a-username@a-hostname --server-password=a-user-password --server-control-username=a-username@a-hostname --server-control-password=a-user-password --readonly > /dev/null 2>&1 &",
+		},
 		{
 			f: func() []string {
 				args := ServerStatusCommandArgs{