diff --git a/src/rebar_hex_repos.erl b/src/rebar_hex_repos.erl
index b9d4bca4..f7a9dabb 100644
--- a/src/rebar_hex_repos.erl
+++ b/src/rebar_hex_repos.erl
@@ -3,6 +3,7 @@
 -export([from_state/2,
          get_repo_config/2,
          auth_config/1,
+         remove_from_auth_config/2,
          update_auth_config/2,
          format_error/1]).
 
@@ -158,11 +159,19 @@ auth_config(State) ->
             ?ABORT("Error found in repos auth config (~ts) at line ~ts", [AuthFile, Reason])
     end.
 
+-spec remove_from_auth_config(term(), rebar_state:t()) -> ok.
+remove_from_auth_config(Key, State) ->
+    Updated = maps:remove(Key, auth_config(State)),
+    write_auth_config(Updated, State).
+
 -spec update_auth_config(map(), rebar_state:t()) -> ok.
 update_auth_config(Updates, State) ->
-    Config = auth_config(State),
+    Updated = maps:merge(auth_config(State), Updates),
+    write_auth_config(Updated, State).
+
+write_auth_config(Config, State) ->
     AuthConfigFile = auth_config_file(State),
     ok = filelib:ensure_dir(AuthConfigFile),
     NewConfig = iolist_to_binary(["%% coding: utf-8", io_lib:nl(),
-                                  io_lib:print(maps:merge(Config, Updates)), ".", io_lib:nl()]),
+                                  io_lib:print(Config), ".", io_lib:nl()]),
     ok = file:write_file(AuthConfigFile, NewConfig, [{encoding, utf8}]).
diff --git a/test/rebar_pkg_repos_SUITE.erl b/test/rebar_pkg_repos_SUITE.erl
index e972ecf2..3d021c8c 100644
--- a/test/rebar_pkg_repos_SUITE.erl
+++ b/test/rebar_pkg_repos_SUITE.erl
@@ -9,7 +9,7 @@
 
 all() ->
     [default_repo, repo_merging, repo_replacing,
-     auth_read_write_read, auth_merging, auth_config_errors, organization_merging,
+     auth_read_write_read, auth_remove_from_config, auth_merging, auth_config_errors, organization_merging,
      {group, resolve_version}].
 
 groups() ->
@@ -121,7 +121,9 @@ init_per_testcase(optional_prereleases, Config) ->
 
     [{state, State} | Config];
 init_per_testcase(Case, Config) when Case =:= auth_merging ;
-                                     Case =:= auth_config_errors ->
+                                     Case =:= auth_config_errors ;
+                                     Case =:= auth_remove_from_config ;
+                                     Case =:= auth_read_write_read ->
     meck:new(file, [passthrough, no_link, unstick]),
     meck:new(rebar_packages, [passthrough, no_link]),
     Config;
@@ -134,7 +136,9 @@ init_per_testcase(_, Config) ->
 
 end_per_testcase(Case, _Config) when Case =:= auth_merging ;
                                      Case =:= auth_config_errors ;
-                                     Case =:= organization_merging ->
+                                     Case =:= organization_merging ;
+                                     Case =:= auth_remove_from_config ;
+                                     Case =:= auth_read_write_read ->
     meck:unload(file),
     meck:unload(rebar_packages);
 end_per_testcase(Case, _Config) when Case =:= use_first_repo_match ;
@@ -273,9 +277,62 @@ auth_config_errors(_Config) ->
     ok.
 
 auth_read_write_read(_Config) ->
-    State = rebar_state:new([]),
-    rebar_hex_repos:update_auth_config(#{"foo" => <<200>>}, State),
-    rebar_hex_repos:update_auth_config(#{"foo" => <<200>>}, State).
+    Repo1 = #{name => <<"hexpm:repo-1">>,
+              api_url => <<"repo-1/api">>},
+    Repo2 = #{name => <<"hexpm:repo-2">>,
+              repo_url => <<"repo-2/repo">>,
+              repo_verify => false},
+    State = rebar_state:new([{hex, [{repos, [Repo1, Repo2]}]}]),
+
+    meck:expect(file, consult,
+                fun(_) ->
+                        {ok, [#{<<"hexpm:repo-1">> => #{read_key => <<"read key">>},
+                                <<"hexpm:repo-2">> => #{read_key => <<"read key 2">>,
+                                                        repos_key => <<"repos key 2">>,
+                                                        write_key => <<"write key 2">>}}]}
+                end),
+
+    meck:expect(file, write_file,
+                fun(_File, CfgBin, _) ->
+                        case binary:match(CfgBin, <<"foo">>) of
+                            nomatch ->
+                                Err = "expected auth config binary with key <<\"foo\">>",
+                                meck:exception(error, {expected, Err});
+                            _ ->
+                                ok
+                        end
+                end),
+
+    rebar_hex_repos:update_auth_config(#{<<"foo">> => <<200>>}, State).
+
+auth_remove_from_config(_Config) ->
+    Repo1 = #{name => <<"hexpm:repo-1">>,
+              api_url => <<"repo-1/api">>},
+    Repo2 = #{name => <<"hexpm:repo-2">>,
+              repo_url => <<"repo-2/repo">>,
+              repo_verify => false},
+    State = rebar_state:new([{hex, [{repos, [Repo1, Repo2]}]}]),
+
+    meck:expect(file, consult,
+                fun(_) ->
+                        {ok, [#{<<"hexpm:repo-1">> => #{read_key => <<"read key">>},
+                                <<"hexpm:repo-2">> => #{read_key => <<"read key 2">>,
+                                                        repos_key => <<"repos key 2">>,
+                                                        write_key => <<"write key 2">>}}]}
+                end),
+
+    meck:expect(file, write_file,
+                fun(_File, CfgBin, _) ->
+                        case binary:match(CfgBin, <<"hexpm:repo-1">>) of
+                            nomatch ->
+                                ok;
+                            _ ->
+                                Err = "expected auth config binary without key <<\"hexpm:repo-1\">>",
+                                meck:exception(error, {expected, Err})
+                        end
+                end),
+
+    rebar_hex_repos:remove_from_auth_config(<<"hexpm:repo-1">>, State).
 
 organization_merging(_Config) ->
     Repo1 = #{name => <<"hexpm:repo-1">>,