diff --git a/jupyterhub_ssh/__init__.py b/jupyterhub_ssh/__init__.py
index 6415113..8549df1 100644
--- a/jupyterhub_ssh/__init__.py
+++ b/jupyterhub_ssh/__init__.py
@@ -23,6 +23,7 @@ class NotebookSSHServer(asyncssh.SSHServer):
 
     def __init__(self, app, *args, **kwargs):
         self.app = app
+        self.fail_banner_sent = False
         super().__init__(*args, **kwargs)
 
     def connection_made(self, conn):
@@ -106,6 +107,9 @@ async def validate_password(self, username, token):
         async with ClientSession(headers=headers) as session:
             notebook_url = await self.start_user_server(session, username)
             if notebook_url is None:
+                if self.app.banner_auth_fail and not self.fail_banner_sent:
+                    self.fail_banner_sent = True
+                    self._conn.send_auth_banner(self.app.banner_auth_fail)
                 return False
             else:
                 self.notebook_url = notebook_url
@@ -287,6 +291,15 @@ def _hub_url_cast_string_to_yarl_url(self, proposal):
         config=True,
     )
 
+    banner_auth_fail = Unicode(
+        "",
+        help="""
+        Text to be presented to client when authentication fails the first time.
+        Can be used to point the user to documentation.
+        """,
+        config=True
+    )
+
     def init_logging(self):
         """
         Make traitlets & asyncssh logging work properly