diff --git a/pkg/cli/clients/aserto_tenant_connection_client.go b/pkg/cli/clients/aserto_tenant_connection_client.go
index 45d3ce22..5b80e37b 100644
--- a/pkg/cli/clients/aserto_tenant_connection_client.go
+++ b/pkg/cli/clients/aserto_tenant_connection_client.go
@@ -11,6 +11,7 @@ import (
 type TenantConfig struct {
 	Address  string
 	APIKey   string
+	Token    string
 	TenantID string
 	Insecure bool
 }
@@ -25,6 +26,9 @@ func NewTenantConnectionClient(c *cc.CommonCtx, cfg *TenantConfig) (connection.C
 		grpcClient.WithInsecure(cfg.Insecure),
 	}
 
+	if cfg.Token != "" {
+		opts = append(opts, grpcClient.WithTokenAuth(cfg.Token))
+	}
 	if cfg.APIKey != "" {
 		opts = append(opts, grpcClient.WithAPIKeyAuth(cfg.APIKey))
 	}
diff --git a/pkg/cli/cmd/configure.go b/pkg/cli/cmd/configure.go
index 51bf4abb..9a14a02f 100644
--- a/pkg/cli/cmd/configure.go
+++ b/pkg/cli/cmd/configure.go
@@ -29,7 +29,8 @@ type ConfigureCmd struct {
 	EdgeAuthorizer    bool   `short:"e" help:"configure topaz to work as an edge authorizer connected to the aserto control plane" default:"false"`
 	TenantAddress     string `help:"aserto tenant service address" default:"tenant.prod.aserto.com:8443"`
 	TenantID          string `help:"your aserto tenant id"`
-	TenantKey         string `help:"API key to connect to the tenant service"`
+	TenantAPIKey      string `help:"root API key to connect to the tenant service"`
+	TenantToken       string `help:"token to connect to the tenant service"`
 	ConnectionID      string `help:"edge authorizer connection id"`
 	DiscoveryURL      string `help:"discovery service url" default:"https://discovery.prod.aserto.com/api/v2/discovery"`
 	DiscoveryKey      string `help:"discovery service api key"`
@@ -69,7 +70,8 @@ func (cmd ConfigureCmd) Run(c *cc.CommonCtx) error {
 
 		clientConfig := clients.TenantConfig{
 			Address:  cmd.TenantAddress,
-			APIKey:   cmd.TenantKey,
+			Token:    cmd.TenantToken,
+			APIKey:   cmd.TenantAPIKey,
 			TenantID: cmd.TenantID,
 			Insecure: true,
 		}