diff --git a/bin/cli b/bin/cli
index 6fd3e3ad544..94ca159f30e 100755
--- a/bin/cli
+++ b/bin/cli
@@ -126,6 +126,8 @@ if __name__ == "__main__":
       action="store_true", default=False, help="turn on verbose logging")
     parser.add_option("-f", "--logfile", dest="logfile",
       type="string", default="syslog", help="log file path")
+    parser.add_option("-t", "--token", dest="token",
+      type="string", default=None, help="authentication token")
     options, args = parser.parse_args()
 
     if options.verbose:
@@ -158,7 +160,8 @@ if __name__ == "__main__":
     LOG.info("Executing command \"%s\" with args: %s" % (cmd, args))
 
     client = Client(options.host, options.port, options.ssl,
-                    args[0], FORMAT)
+                    args[0], FORMAT,
+                    auth_token=options.token)
     commands[cmd]["func"](client, *args)
 
     LOG.info("Command execution completed")
diff --git a/quantum/client.py b/quantum/client.py
index ffcb3a3b679..325a66edbb3 100644
--- a/quantum/client.py
+++ b/quantum/client.py
@@ -34,6 +34,7 @@ EXCEPTIONS = {
     431: exceptions.StateInvalid,
     432: exceptions.PortInUseClient,
     440: exceptions.AlreadyAttachedClient}
+AUTH_TOKEN_HEADER = "X-Auth-Token"
 
 
 class ApiCall(object):
@@ -83,7 +84,8 @@ class Client(object):
 
     def __init__(self, host="127.0.0.1", port=9696, use_ssl=False, tenant=None,
                 format="xml", testingStub=None, key_file=None, cert_file=None,
-                logger=None, action_prefix="/v1.0/tenants/{tenant_id}"):
+                auth_token=None, logger=None,
+                action_prefix="/v1.0/tenants/{tenant_id}"):
         """
         Creates a new client to some service.
 
@@ -95,6 +97,9 @@ class Client(object):
         :param testingStub: A class that stubs basic server methods for tests
         :param key_file: The SSL key file to use if use_ssl is true
         :param cert_file: The SSL cert file to use if use_ssl is true
+        :param auth_token: authentication token to be passed to server
+        :param logger: Logger object for the client library
+        :param action_prefix: prefix for request URIs
         """
         self.host = host
         self.port = port
@@ -106,6 +111,7 @@ class Client(object):
         self.key_file = key_file
         self.cert_file = cert_file
         self.logger = logger
+        self.auth_token = auth_token
         self.action_prefix = action_prefix
 
     def get_connection_type(self):
@@ -163,6 +169,9 @@ class Client(object):
             connection_type = self.get_connection_type()
             headers = headers or {"Content-Type":
                                       "application/%s" % self.format}
+            # if available, add authentication token
+            if self.auth_token:
+                headers[AUTH_TOKEN_HEADER] = self.auth_token
             # Open connection and send request, handling SSL certs
             certs = {'key_file': self.key_file, 'cert_file': self.cert_file}
             certs = dict((x, certs[x]) for x in certs if certs[x] != None)