diff --git a/config/bridge.go b/config/bridge.go
index 689c263..538908f 100644
--- a/config/bridge.go
+++ b/config/bridge.go
@@ -136,8 +136,9 @@ type BridgeConfig struct {
 	Encryption bridgeconfig.EncryptionConfig `yaml:"encryption"`
 
 	Provisioning struct {
-		Prefix       string `yaml:"prefix"`
-		SharedSecret string `yaml:"shared_secret"`
+		Prefix         string `yaml:"prefix"`
+		SharedSecret   string `yaml:"shared_secret"`
+		DebugEndpoints bool   `yaml:"debug_endpoints"`
 	} `yaml:"provisioning"`
 
 	Permissions bridgeconfig.PermissionConfig `yaml:"permissions"`
diff --git a/config/upgrade.go b/config/upgrade.go
index 570e201..b1999c8 100644
--- a/config/upgrade.go
+++ b/config/upgrade.go
@@ -160,6 +160,7 @@ func DoUpgrade(helper *up.Helper) {
 	} else {
 		helper.Copy(up.Str, "bridge", "provisioning", "prefix")
 	}
+	helper.Copy(up.Bool, "bridge", "provisioning", "debug_endpoints")
 	if secret, ok := helper.Get(up.Str, "appservice", "provisioning", "shared_secret"); ok && secret != "generate" {
 		helper.Set(up.Str, secret, "bridge", "provisioning", "shared_secret")
 	} else if secret, ok = helper.Get(up.Str, "bridge", "provisioning", "shared_secret"); !ok || secret == "generate" {
diff --git a/example-config.yaml b/example-config.yaml
index 95ed83d..058f3e1 100644
--- a/example-config.yaml
+++ b/example-config.yaml
@@ -424,6 +424,8 @@ bridge:
         # Shared secret for authentication. If set to "generate", a random secret will be generated,
         # or if set to "disable", the provisioning API will be disabled.
         shared_secret: generate
+        # Enable debug API at /debug with provisioning authentication.
+        debug_endpoints: false
 
     # Permissions for using the bridge.
     # Permitted values:
diff --git a/provisioning.go b/provisioning.go
index 65c8a2b..911338d 100644
--- a/provisioning.go
+++ b/provisioning.go
@@ -24,6 +24,7 @@ import (
 	"fmt"
 	"net"
 	"net/http"
+	_ "net/http/pprof"
 	"strings"
 	"time"
 
@@ -71,6 +72,13 @@ func (prov *ProvisioningAPI) Init() {
 	prov.bridge.AS.Router.HandleFunc("/_matrix/app/com.beeper.asmux/ping", prov.BridgeStatePing).Methods(http.MethodPost)
 	prov.bridge.AS.Router.HandleFunc("/_matrix/app/com.beeper.bridge_state", prov.BridgeStatePing).Methods(http.MethodPost)
 
+	if prov.bridge.Config.Bridge.Provisioning.DebugEndpoints {
+		prov.log.Debugln("Enabling debug API at /debug")
+		r := prov.bridge.AS.Router.PathPrefix("/debug").Subrouter()
+		r.Use(prov.AuthMiddleware)
+		r.PathPrefix("/pprof").Handler(http.DefaultServeMux)
+	}
+
 	// Deprecated, just use /disconnect
 	r.HandleFunc("/v1/delete_connection", prov.Disconnect).Methods(http.MethodPost)
 }