diff --git a/lib/puppet/provider/barbican_api_paste_ini/ini_setting.rb b/lib/puppet/provider/barbican_api_paste_ini/ini_setting.rb
new file mode 100644
index 00000000..10c7faee
--- /dev/null
+++ b/lib/puppet/provider/barbican_api_paste_ini/ini_setting.rb
@@ -0,0 +1,10 @@
+Puppet::Type.type(:barbican_api_paste_ini).provide(
+  :ini_setting,
+  :parent => Puppet::Type.type(:openstack_config).provider(:ini_setting)
+) do
+
+  def self.file_path
+    '/etc/barbican/barbican-api-paste.ini'
+  end
+
+end
diff --git a/lib/puppet/type/barbican_api_paste_ini.rb b/lib/puppet/type/barbican_api_paste_ini.rb
new file mode 100644
index 00000000..0fda47c8
--- /dev/null
+++ b/lib/puppet/type/barbican_api_paste_ini.rb
@@ -0,0 +1,56 @@
+Puppet::Type.newtype(:barbican_api_paste_ini) do
+
+  ensurable
+
+  newparam(:name, :namevar => true) do
+    desc 'Section/setting name to manage from barbican-api-paste.ini'
+    newvalues(/\S+\/\S+/)
+  end
+
+  newproperty(:value) do
+    desc 'The value of the setting to be defined.'
+    munge do |value|
+      value = value.to_s.strip
+      value.capitalize! if value =~ /^(true|false)$/i
+      value
+    end
+
+    def is_to_s( currentvalue )
+      if resource.secret?
+        return '[old secret redacted]'
+      else
+        return currentvalue
+      end
+    end
+
+    def should_to_s( newvalue )
+      if resource.secret?
+        return '[new secret redacted]'
+      else
+        return newvalue
+      end
+    end
+  end
+
+  newparam(:secret, :boolean => true) do
+    desc 'Whether to hide the value from Puppet logs. Defaults to `false`.'
+
+    newvalues(:true, :false)
+
+    defaultto false
+  end
+
+  newparam(:ensure_absent_val) do
+    desc 'A value that is specified as the value property will behave as if ensure => absent was specified'
+    defaultto('<SERVICE DEFAULT>')
+  end
+
+  autorequire(:package) do
+    if Facter.value(:osfamily) == 'Debian'
+      'barbican-api'
+    elsif Facter.value(:osfamily) == 'RedHat'
+      'openstack-barbican-api'
+    end
+  end
+
+end
diff --git a/manifests/config.pp b/manifests/config.pp
index c10fe8da..662f470f 100644
--- a/manifests/config.pp
+++ b/manifests/config.pp
@@ -4,7 +4,7 @@
 #
 # === Parameters
 #
-# [*barbican_config*]
+# [*xxx_config*]
 #   (optional) Allow configuration of arbitrary barbican configurations.
 #   The value is an hash of barbican_config resources. Example:
 #   { 'DEFAULT/foo' => { value => 'fooValue'},
@@ -17,14 +17,22 @@
 #     DEFAULT/bar:
 #       value: barValue
 #
+# [*api_config*]
+# (optional) Allow configuration of barbican-api.conf configurations.
+#
+# [*api_paste_ini_config*]
+# (optional) Allow configuration of barbican-api-paste.ini configurations.
+#
 #   NOTE: The configuration MUST NOT be already handled by this module
 #   or Puppet catalog compilation will fail with duplicate resources.
 #
 class barbican::config (
-  $barbican_config = {},
+  $api_config = {},
+  $api_paste_ini_config = {},
 ) {
+  validate_hash($api_config)
+  validate_hash($api_paste_ini_config)
 
-  validate_hash($barbican_config)
-
-  create_resources('barbican_config', $barbican_config)
+  create_resources('barbican_config', $api_config)
+  create_resources('barbican_api_paste_ini', $api_paste_ini_config)
 }
diff --git a/spec/unit/provider/barbican_api_paste_ini/ini_setting_spec.rb b/spec/unit/provider/barbican_api_paste_ini/ini_setting_spec.rb
new file mode 100644
index 00000000..98ad0c76
--- /dev/null
+++ b/spec/unit/provider/barbican_api_paste_ini/ini_setting_spec.rb
@@ -0,0 +1,64 @@
+$LOAD_PATH.push(
+  File.join(
+    File.dirname(__FILE__),
+    '..',
+    '..',
+    '..',
+    'fixtures',
+    'modules',
+    'inifile',
+    'lib')
+)
+$LOAD_PATH.push(
+  File.join(
+    File.dirname(__FILE__),
+    '..',
+    '..',
+    '..',
+    'fixtures',
+    'modules',
+    'openstacklib',
+    'lib')
+)
+require 'spec_helper'
+provider_class = Puppet::Type.type(:barbican_api_paste_ini).provider(:ini_setting)
+describe provider_class do
+
+  it 'should default to the default setting when no other one is specified' do
+    resource = Puppet::Type::Barbican_api_paste_ini.new(
+      {:name => 'DEFAULT/foo', :value => 'bar'}
+    )
+    provider = provider_class.new(resource)
+    expect(provider.section).to eq('DEFAULT')
+    expect(provider.setting).to eq('foo')
+  end
+
+  it 'should allow setting to be set explicitly' do
+    resource = Puppet::Type::Barbican_api_paste_ini.new(
+      {:name => 'dude/whoa', :value => 'bar'}
+    )
+    provider = provider_class.new(resource)
+    expect(provider.section).to eq('dude')
+    expect(provider.setting).to eq('whoa')
+  end
+
+  it 'should ensure absent when <SERVICE DEFAULT> is specified as a value' do
+    resource = Puppet::Type::Barbican_api_paste_ini.new(
+      {:name => 'dude/foo', :value => '<SERVICE DEFAULT>'}
+    )
+    provider = provider_class.new(resource)
+    provider.exists?
+    expect(resource[:ensure]).to eq :absent
+  end
+
+  it 'should ensure absent when value matches ensure_absent_val' do
+    resource = Puppet::Type::Barbican_api_paste_ini.new(
+      {:name => 'dude/foo', :value => 'foo', :ensure_absent_val => 'foo' }
+    )
+    provider = provider_class.new(resource)
+    provider.exists?
+    expect(resource[:ensure]).to eq :absent
+  end
+
+end
+
diff --git a/spec/unit/type/barbican_api_paste_ini_spec.rb b/spec/unit/type/barbican_api_paste_ini_spec.rb
new file mode 100644
index 00000000..2bc41e33
--- /dev/null
+++ b/spec/unit/type/barbican_api_paste_ini_spec.rb
@@ -0,0 +1,79 @@
+require 'puppet'
+require 'puppet/type/barbican_api_paste_ini'
+
+describe 'Puppet::Type.type(:barbican_api_paste_ini)' do
+  before :each do
+    Puppet::Type.rmtype(:barbican_api_paste_ini)
+    Facter.fact(:osfamily).stubs(:value).returns(platform_params[:osfamily])
+    @barbican_api_paste_ini = Puppet::Type.type(:barbican_api_paste_ini).new(:name => 'DEFAULT/foo', :value => 'bar')
+  end
+
+  shared_examples_for 'barbican_api_paste_ini' do
+
+    it 'should require a name' do
+      expect {
+        Puppet::Type.type(:barbican_api_paste_ini).new({})
+      }.to raise_error(Puppet::Error, 'Title or name must be provided')
+    end
+
+    it 'should not expect a name with whitespace' do
+      expect {
+        Puppet::Type.type(:barbican_api_paste_ini).new(:name => 'f oo')
+      }.to raise_error(Puppet::Error, /Parameter name failed/)
+    end
+
+    it 'should fail when there is no section' do
+      expect {
+        Puppet::Type.type(:barbican_api_paste_ini).new(:name => 'foo')
+      }.to raise_error(Puppet::Error, /Parameter name failed/)
+    end
+
+    it 'should not require a value when ensure is absent' do
+      Puppet::Type.type(:barbican_api_paste_ini).new(:name => 'DEFAULT/foo', :ensure => :absent)
+    end
+
+    it 'should accept a valid value' do
+      @barbican_api_paste_ini[:value] = 'bar'
+      expect(@barbican_api_paste_ini[:value]).to eq('bar')
+    end
+
+    it 'should not accept a value with whitespace' do
+      @barbican_api_paste_ini[:value] = 'b ar'
+      expect(@barbican_api_paste_ini[:value]).to eq('b ar')
+    end
+
+    it 'should accept valid ensure values' do
+      @barbican_api_paste_ini[:ensure] = :present
+      expect(@barbican_api_paste_ini[:ensure]).to eq(:present)
+      @barbican_api_paste_ini[:ensure] = :absent
+      expect(@barbican_api_paste_ini[:ensure]).to eq(:absent)
+    end
+
+    it 'should not accept invalid ensure values' do
+      expect {
+        @barbican_api_paste_ini[:ensure] = :latest
+      }.to raise_error(Puppet::Error, /Invalid value/)
+    end
+
+    it 'should autorequire the package that install the file' do
+      catalog = Puppet::Resource::Catalog.new
+      package = Puppet::Type.type(:package).new(:name => platform_params[:package_name])
+      catalog.add_resource package, @barbican_api_paste_ini
+      dependency = @barbican_api_paste_ini.autorequire
+      expect(dependency.size).to eq(1)
+      expect(dependency[0].target).to eq(@barbican_api_paste_ini)
+      expect(dependency[0].source).to eq(package)
+    end
+  end
+
+  context 'on RedHat platforms' do
+    let :platform_params do
+      { :package_name => 'openstack-barbican-api',
+        :osfamily     => 'RedHat'}
+    end
+
+    it_behaves_like 'barbican_api_paste_ini'
+  end
+
+end
+