I happened to run across an unrelated github issue: https://github.com/terraform-providers/terraform-provider-openstack/issu es/271 which gave me a clue to what I was missing. I needed to include some additional variables (see steps 7 through 9 below). Revised steps - which works fine with the OpenStack Client: 0) set appropriate OS_* variables for password authentication 1) create a token using "openstack token issue" 2) unset all OS_* environment variables 3) set OS_TOKEN to the token's value provided in #1 4) set OS_AUTH_TYPE to "v3token" 5) set OS_AUTH_URL to the respective KeyStone endpoint 6) set OS_IDENTITY_API_VERSION to "3" 7) set OS_PROJECT_DOMAIN_ID as appropriate 8) set OS_PROJECT_NAME as appropriate 9) set OS_REGION_NAME as appropriate 10) use the CLI as normal This shaves anywhere from 0.2 to 0.6 seconds off of a test command I'm running when compared to password authentication (which normally takes about 2.5 seconds to run), where a new token is issued each time. openstack token revoke works as expected too. Eric