diff --git a/manifests/api.pp b/manifests/api.pp
index a274bac8..a7b9f54b 100644
--- a/manifests/api.pp
+++ b/manifests/api.pp
@@ -237,6 +237,10 @@
 #   (optional) CA certificate file to use to verify connecting clients
 #   Defaults to $::os_service_default
 #
+# [*keystone_auth_type*]
+#   (optional) An authentication plugin to use with an OpenStack Identity server.
+#   Defaults to 'password'
+#
 class barbican::api (
   $ensure_package                                = 'present',
   $client_package_ensure                         = 'present',
@@ -290,6 +294,7 @@ class barbican::api (
   $cert_file                                     = $::os_service_default,
   $key_file                                      = $::os_service_default,
   $service_name                                  = 'barbican-api',
+  $keystone_auth_type                            = 'password',
 ) inherits barbican::params {
 
   include ::barbican::db
@@ -415,7 +420,7 @@ class barbican::api (
     }
 
     barbican_config {
-      'keystone_authtoken/auth_plugin':       value => 'password';
+      'keystone_authtoken/auth_type':         value => $keystone_auth_type;
       'keystone_authtoken/auth_url':          value => $auth_url;
       'keystone_authtoken/project_name':      value => $keystone_tenant;
       'keystone_authtoken/username':          value => $keystone_user;
@@ -430,6 +435,7 @@ class barbican::api (
 
     barbican_config {
       'keystone_authtoken/auth_plugin':       ensure => 'absent';
+      'keystone_authtoken/auth_type':         ensure => 'absent';
       'keystone_authtoken/auth_uri':          ensure => 'absent';
       'keystone_authtoken/project_name':      ensure => 'absent';
       'keystone_authtoken/username':          ensure => 'absent';
diff --git a/spec/classes/barbican_api_spec.rb b/spec/classes/barbican_api_spec.rb
index b680fd4e..3ad62597 100644
--- a/spec/classes/barbican_api_spec.rb
+++ b/spec/classes/barbican_api_spec.rb
@@ -218,6 +218,7 @@ describe 'barbican::api' do
       {
         :auth_type            => 'keystone',
         :keystone_password    => 'foobar',
+        :keystone_auth_type   => 'passwordv3',
       }
     end
 
@@ -228,6 +229,8 @@ describe 'barbican::api' do
         .with_value('http://localhost:35357')
       is_expected.to contain_barbican_config('keystone_authtoken/project_name')\
         .with_value('services')
+      is_expected.to contain_barbican_config('keystone_authtoken/auth_type')\
+        .with_value('passwordv3')
     end
   end