diff --git a/heatclient/common/http.py b/heatclient/common/http.py
index f6aabd66..bdf212dc 100644
--- a/heatclient/common/http.py
+++ b/heatclient/common/http.py
@@ -131,6 +131,8 @@ class HTTPClient(object):
         kwargs['headers'].setdefault('User-Agent', USER_AGENT)
         if self.auth_token:
             kwargs['headers'].setdefault('X-Auth-Token', self.auth_token)
+        else:
+            kwargs['headers'].update(self.credentials_headers())
         if self.auth_url:
             kwargs['headers'].setdefault('X-Auth-Url', self.auth_url)
 
@@ -175,10 +177,12 @@ class HTTPClient(object):
         return resp, body_str
 
     def credentials_headers(self):
-        return {
-            'X-Auth-User': self.username,
-            'X-Auth-Key': self.password
-        }
+        creds = {}
+        if self.username:
+            creds['X-Auth-User'] = self.username
+        if self.password:
+            creds['X-Auth-Key'] = self.password
+        return creds
 
     def json_request(self, method, url, **kwargs):
         kwargs.setdefault('headers', {})
diff --git a/heatclient/tests/test_common_http.py b/heatclient/tests/test_common_http.py
index 49c8a3db..6b106c7e 100644
--- a/heatclient/tests/test_common_http.py
+++ b/heatclient/tests/test_common_http.py
@@ -37,6 +37,56 @@ class HttpClientTest(testtools.TestCase):
         self.assertEqual(''.join([x for x in body]), '')
         self.m.VerifyAll()
 
+    def test_token_or_credentials(self):
+        # Record a 200
+        fake200 = fakes.FakeHTTPResponse(
+            200, 'OK',
+            {'content-type': 'application/octet-stream'},
+            '')
+
+        # no token or credentials
+        mock_conn = http.httplib.HTTPConnection('example.com', 8004,
+                                                timeout=600.0)
+        mock_conn.request('GET', '/',
+                          headers={'Content-Type': 'application/octet-stream',
+                                   'User-Agent': 'python-heatclient'})
+        mock_conn.getresponse().AndReturn(fake200)
+
+        # credentials
+        mock_conn = http.httplib.HTTPConnection('example.com', 8004,
+                                                timeout=600.0)
+        mock_conn.request('GET', '/',
+                          headers={'Content-Type': 'application/octet-stream',
+                                   'User-Agent': 'python-heatclient',
+                                   'X-Auth-Key': 'pass',
+                                   'X-Auth-User': 'user'})
+        mock_conn.getresponse().AndReturn(fake200)
+
+        # token suppresses credentials
+        mock_conn = http.httplib.HTTPConnection('example.com', 8004,
+                                                timeout=600.0)
+        mock_conn.request('GET', '/',
+                          headers={'Content-Type': 'application/octet-stream',
+                                   'User-Agent': 'python-heatclient',
+                                   'X-Auth-Token': 'abcd1234'})
+        mock_conn.getresponse().AndReturn(fake200)
+
+        # Replay, create client, assert
+        self.m.ReplayAll()
+        client = http.HTTPClient('http://example.com:8004')
+        resp, body = client.raw_request('GET', '')
+        self.assertEqual(resp.status, 200)
+
+        client.username = 'user'
+        client.password = 'pass'
+        resp, body = client.raw_request('GET', '')
+        self.assertEqual(resp.status, 200)
+
+        client.auth_token = 'abcd1234'
+        resp, body = client.raw_request('GET', '')
+        self.assertEqual(resp.status, 200)
+        self.m.VerifyAll()
+
     def test_http_json_request(self):
         # Record a 200
         mock_conn = http.httplib.HTTPConnection('example.com', 8004,