diff --git a/manifests/api.pp b/manifests/api.pp
index b58e2fb92..0aac0fa59 100644
--- a/manifests/api.pp
+++ b/manifests/api.pp
@@ -480,8 +480,7 @@ as a standalone service, or httpd for being run by a httpd server")
     #Admin tenant name real
     $atnr = $::nova::keystone::authtoken::project_name
     #Keystone Auth URI
-    # TODO(tobasco): Remove pick when auth_uri is removed.
-    $kau = pick($::nova::keystone::authtoken::auth_uri, $::nova::keystone::authtoken::www_authenticate_uri)
+    $kau = $::nova::keystone::authtoken::www_authenticate_uri
     $defaults = {
       'nova-api' => {
         'command'  => "nova --os-auth-url ${kau} --os-project-name ${atnr} --os-username ${aur} --os-password ${apr} flavor-list",
diff --git a/manifests/keystone/authtoken.pp b/manifests/keystone/authtoken.pp
index 2a0c8c5b2..e70baeb5c 100644
--- a/manifests/keystone/authtoken.pp
+++ b/manifests/keystone/authtoken.pp
@@ -163,10 +163,6 @@
 #
 # DEPRECATED PARAMETERS
 #
-# [*auth_uri*]
-#   (Optional) Complete public Identity API endpoint.
-#   Defaults to undef
-#
 # [*check_revocations_for_cached*]
 #   (Optional) If true, the revocation list will be checked for cached tokens.
 #   This requires that PKI tokens are configured on the identity server.
@@ -218,7 +214,6 @@ class nova::keystone::authtoken(
   $region_name                    = $::os_service_default,
   $token_cache_time               = $::os_service_default,
   # DEPRECATED PARAMETERS
-  $auth_uri                       = undef,
   $check_revocations_for_cached   = undef,
   $hash_algorithms                = undef,
 ) {
@@ -229,11 +224,6 @@ class nova::keystone::authtoken(
     fail('Please set password for nova service user')
   }
 
-  if $auth_uri {
-    warning('The auth_uri parameter is deprecated. Please use www_authenticate_uri instead.')
-  }
-  $www_authenticate_uri_real = pick($auth_uri, $www_authenticate_uri)
-
   if $check_revocations_for_cached {
     warning('check_revocations_for_cached parameter is deprecated, has no effect and will be removed in the future.')
   }
@@ -247,7 +237,7 @@ class nova::keystone::authtoken(
     password                       => $password,
     project_name                   => $project_name,
     auth_url                       => $auth_url,
-    www_authenticate_uri           => $www_authenticate_uri_real,
+    www_authenticate_uri           => $www_authenticate_uri,
     auth_version                   => $auth_version,
     auth_type                      => $auth_type,
     auth_section                   => $auth_section,
diff --git a/manifests/metadata/novajoin/authtoken.pp b/manifests/metadata/novajoin/authtoken.pp
index 59e3f7c4a..7de79ed8b 100644
--- a/manifests/metadata/novajoin/authtoken.pp
+++ b/manifests/metadata/novajoin/authtoken.pp
@@ -178,12 +178,6 @@
 #   (in seconds). Set to -1 to disable caching completely. Integer value
 #   Defaults to $::os_service_default.
 #
-# DEPRECATED PARAMETERS
-#
-# [*auth_uri*]
-#   (Optional) Complete public Identity API endpoint.
-#   Defaults to undef
-#
 class nova::metadata::novajoin::authtoken(
   $username                       = 'novajoin',
   $password                       = $::os_service_default,
@@ -219,25 +213,18 @@ class nova::metadata::novajoin::authtoken(
   $manage_memcache_package        = false,
   $region_name                    = $::os_service_default,
   $token_cache_time               = $::os_service_default,
-  # DEPRECATED PARAMETERS
-  $auth_uri                       = undef,
 ) {
 
   if is_service_default($password) {
     fail('Please set password for novajoin service user')
   }
 
-  if $auth_uri {
-    warning('The auth_uri parameter is deprecated. Please use www_authenticate_uri instead.')
-  }
-  $www_authenticate_uri_real = pick($auth_uri, $www_authenticate_uri)
-
   keystone::resource::authtoken { 'novajoin_config':
     username                       => $username,
     password                       => $password,
     project_name                   => $project_name,
     auth_url                       => $auth_url,
-    www_authenticate_uri           => $www_authenticate_uri_real,
+    www_authenticate_uri           => $www_authenticate_uri,
     auth_version                   => $auth_version,
     auth_type                      => $auth_type,
     auth_section                   => $auth_section,
diff --git a/releasenotes/notes/remove-auth-uri-6e98c7c2bf6a8932.yaml b/releasenotes/notes/remove-auth-uri-6e98c7c2bf6a8932.yaml
new file mode 100644
index 000000000..b3e371976
--- /dev/null
+++ b/releasenotes/notes/remove-auth-uri-6e98c7c2bf6a8932.yaml
@@ -0,0 +1,4 @@
+---
+upgrade:
+  - |
+    The deprecated parameter auth_uri is now removed, please use www_authenticate_uri.