In the crowded underwater acoustic channels, the ability to recognize sonar transmissions based on an identifying signature is quite valuable. In this work, we propose an algorithm to embed a watermark in the time-frequency coefficients of a sonar waveform and produce a watermarked sonar. The watermark, which is a digital signature, is used to authenticate the sonar by verifying the source that is broadcasting the waveform. The embedding rule is modeled after spread spectrum modulation and driven by two secure keys. The first key consists of the spreading code that is unique to each source. The second key is an embedding mask used to select and additively modify the selected time-frequency cells of the sonar. The mask is chosen based on the frequency response of the acoustic channel (primarily, its time and frequency coherence) and the signal energy distribution in the time-frequency plane. The detector is modeled after a matched filter receiver performing a replica correlation with the spread watermark passed through the channel model. A successful detection needs access to both the spreading code and the embedding mask. Watermark detection performance is extensively evaluated based on range; watermark energy; watermark placement; ambient noise; number of multipaths; and other ocean parameters, such as depth, surface, and bottom models.