diff --git a/plugin/deploy/heroku/heroku.go b/plugin/deploy/heroku/heroku.go
index 60cca50e..35a80c0e 100644
--- a/plugin/deploy/heroku/heroku.go
+++ b/plugin/deploy/heroku/heroku.go
@@ -14,11 +14,16 @@ const (
 	// individual that made the commit.
 	CmdGlobalEmail = "git config --global user.email $(git --no-pager log -1 --pretty=format:'%ae')"
 	CmdGlobalUser  = "git config --global user.name  $(git --no-pager log -1 --pretty=format:'%an')"
+
+	// Command to write the API token to ~/.netrc
+	// use "_" since heroku git authentication ignores username
+	CmdLogin    = "echo 'machine git.heroku.com login _ password %s' >> ~/.netrc"
 )
 
 type Heroku struct {
 	App   string `yaml:"app,omitempty"`
 	Force bool   `yaml:"force,omitempty"`
+	Token string `yaml:"token,omitempty"`
 
 	Condition *condition.Condition `yaml:"when,omitempty"`
 }
@@ -27,9 +32,10 @@ func (h *Heroku) Write(f *buildfile.Buildfile) {
 	f.WriteCmdSilent(CmdRevParse)
 	f.WriteCmdSilent(CmdGlobalUser)
 	f.WriteCmdSilent(CmdGlobalEmail)
+	f.WriteCmdSilent(fmt.Sprintf(CmdLogin, h.Token))
 
 	// add heroku as a git remote
-	f.WriteCmd(fmt.Sprintf("git remote add heroku git@heroku.com:%s.git", h.App))
+	f.WriteCmd(fmt.Sprintf("git remote add heroku https://git.heroku.com/%s.git", h.App))
 
 	switch h.Force {
 	case true:
diff --git a/plugin/deploy/heroku/heroku_test.go b/plugin/deploy/heroku/heroku_test.go
index b938f603..f4a88b83 100644
--- a/plugin/deploy/heroku/heroku_test.go
+++ b/plugin/deploy/heroku/heroku_test.go
@@ -26,6 +26,18 @@ func Test_Heroku(t *testing.T) {
 			g.Assert(strings.Contains(out, CmdGlobalEmail)).Equal(true)
 		})
 
+		g.It("Should write token", func() {
+			b := new(buildfile.Buildfile)
+			h := Heroku{
+				App: "drone",
+				Token: "mock-token",
+			}
+
+			h.Write(b)
+			out := b.String()
+			g.Assert(strings.Contains(out, "\necho 'machine git.heroku.com login _ password mock-token' >> ~/.netrc\n")).Equal(true)
+			})
+
 		g.It("Should add remote", func() {
 			b := new(buildfile.Buildfile)
 			h := Heroku{
@@ -34,7 +46,7 @@ func Test_Heroku(t *testing.T) {
 
 			h.Write(b)
 			out := b.String()
-			g.Assert(strings.Contains(out, "\ngit remote add heroku git@heroku.com:drone.git\n")).Equal(true)
+			g.Assert(strings.Contains(out, "\ngit remote add heroku https://git.heroku.com/drone.git\n")).Equal(true)
 		})
 
 		g.It("Should push to remote", func() {