diff --git a/bifrost/inventory.py b/bifrost/inventory.py
index 5a021a59d..6ce990944 100755
--- a/bifrost/inventory.py
+++ b/bifrost/inventory.py
@@ -327,8 +327,10 @@ def _identify_shade_auth():
     """Return shade credentials"""
     if os.environ.get('OS_CLOUD'):
         return {}
-    endpoint = os.getenv('OS_URL',
-                         os.getenv('IRONIC_URL', "http://localhost:6385/"))
+    endpoint = os.getenv(
+        'OS_ENDPOINT',
+        os.getenv(
+            'OS_URL', os.getenv('IRONIC_URL', "http://localhost:6385/")))
     options = dict(
         auth_type="None",
         auth=dict(endpoint=endpoint,)
diff --git a/doc/source/user/howto.rst b/doc/source/user/howto.rst
index b81807457..89c022032 100644
--- a/doc/source/user/howto.rst
+++ b/doc/source/user/howto.rst
@@ -37,10 +37,8 @@ Environment variables
 
 The following two environment variables can be set:
 
-- ``OS_URL`` - A URL to the ironic API, such as http://localhost:6385/
-- ``OS_TOKEN`` - Any value except empty space, such as 'fake-token',
-  is required to cause the client library to send requests directly to the
-  API
+- ``OS_AUTH_TYPE`` - set to ``none`` to bypass authentication.
+- ``OS_ENDPOINT`` - A URL to the ironic API, such as http://localhost:6385/
 
 For convenience, an environment file called ``env-vars`` is provided that
 contains default values for these variables and can be sourced to allow the CLI
diff --git a/env-vars b/env-vars
index f3538413f..acdba56a0 100644
--- a/env-vars
+++ b/env-vars
@@ -1,2 +1,2 @@
-export OS_URL=http://localhost:6385/
-export OS_TOKEN='fake-token'
+export OS_ENDPOINT=http://localhost:6385/
+export OS_AUTH_TYPE=none
diff --git a/playbooks/roles/bifrost-keystone-client-config/templates/openrc.j2 b/playbooks/roles/bifrost-keystone-client-config/templates/openrc.j2
index 2e0e2e8d0..75c4c5deb 100644
--- a/playbooks/roles/bifrost-keystone-client-config/templates/openrc.j2
+++ b/playbooks/roles/bifrost-keystone-client-config/templates/openrc.j2
@@ -18,6 +18,6 @@ case "$1" in
     *) echo -e "\nERROR unsupported or unspecified profile: $1\nMust be one of {{ clouds | default({}) | dictsort | map(attribute='0') | join(',') }}";;
 esac
 {% else %}
-export OS_TOKEN='fake-token'
-export OS_URL={{ ironic_api_url }}
+export OS_AUTH_TYPE=none
+export OS_ENDPOINT={{ ironic_api_url }}
 {% endif %}