diff --git a/manifests/proxy/authtoken.pp b/manifests/proxy/authtoken.pp
index 564265cc..38dfd547 100644
--- a/manifests/proxy/authtoken.pp
+++ b/manifests/proxy/authtoken.pp
@@ -71,6 +71,11 @@
 #  true/false
 #  Defaults to $::os_service_default.
 #
+# [*interface*]
+#  (Optional) Interface to use for the Identity API endpoint. Valid values are
+#  "public", "internal" or "admin".
+#  Defaults to $::os_service_default.
+#
 # == DEPRECATED
 #
 # [*identity_uri*]
@@ -116,6 +121,7 @@ class swift::proxy::authtoken(
   $include_service_catalog      = false,
   $service_token_roles          = $::os_service_default,
   $service_token_roles_required = $::os_service_default,
+  $interface                    = $::os_service_default,
   # DEPRECATED PARAMETERS
   $admin_user                   = undef,
   $admin_tenant_name            = undef,
@@ -182,5 +188,6 @@ class swift::proxy::authtoken(
     'filter:authtoken/include_service_catalog':      value => $include_service_catalog;
     'filter:authtoken/service_token_roles':          value => $service_token_roles;
     'filter:authtoken/service_token_roles_required': value => $service_token_roles_required;
+    'filter:authtoken/interface':                    value => $interface,
   }
 }
diff --git a/releasenotes/notes/keystone-authtoken-interface-a0cdde390fca1a46.yaml b/releasenotes/notes/keystone-authtoken-interface-a0cdde390fca1a46.yaml
new file mode 100644
index 00000000..d274835f
--- /dev/null
+++ b/releasenotes/notes/keystone-authtoken-interface-a0cdde390fca1a46.yaml
@@ -0,0 +1,5 @@
+---
+features:
+  - |
+    The new ``swift::proxy::authtoken::interface`` parameter has been added,
+    which can be used to set the interface parameter in authtoken middleware.
diff --git a/spec/classes/swift_proxy_authtoken_spec.rb b/spec/classes/swift_proxy_authtoken_spec.rb
index 91ccf198..362caef3 100644
--- a/spec/classes/swift_proxy_authtoken_spec.rb
+++ b/spec/classes/swift_proxy_authtoken_spec.rb
@@ -34,6 +34,7 @@ describe 'swift::proxy::authtoken' do
       it { is_expected.to contain_swift_proxy_config('filter:authtoken/include_service_catalog').with_value('false') }
       it { is_expected.to contain_swift_proxy_config('filter:authtoken/service_token_roles').with_value('<SERVICE DEFAULT>') }
       it { is_expected.to contain_swift_proxy_config('filter:authtoken/service_token_roles_required').with_value('<SERVICE DEFAULT>') }
+      it { is_expected.to contain_swift_proxy_config('filter:authtoken/interface').with_value('<SERVICE DEFAULT>') }
     end
 
     describe "when overriding parameters" do
@@ -47,6 +48,7 @@ describe 'swift::proxy::authtoken' do
           :signing_dir                  => '/home/swift/keystone-signing',
           :service_token_roles          => ['service'],
           :service_token_roles_required => true,
+          :interface                    => 'internal',
         }
       end
 
@@ -66,6 +68,7 @@ describe 'swift::proxy::authtoken' do
       it { is_expected.to contain_swift_proxy_config('filter:authtoken/include_service_catalog').with_value('false') }
       it { is_expected.to contain_swift_proxy_config('filter:authtoken/service_token_roles').with_value(['service']) }
       it { is_expected.to contain_swift_proxy_config('filter:authtoken/service_token_roles_required').with_value(true) }
+      it { is_expected.to contain_swift_proxy_config('filter:authtoken/interface').with_value('internal') }
     end
 
     describe 'when overriding www_authenticate_uri' do