Comment 18 for bug 1215627

https://github.com/openstack/python-keystoneclient/commit/d734821c99aade7cd4285a5fd51736c475707dcd
it seems the client has done with it via keyring.

keystone --help:
...
  --os-key <key> Defaults to env[OS_KEY]
  --os-cache Use the auth token cache. Defaults to env[OS_CACHE]
  --force-new-token If the keyring is available and in use, token will
                        always be stored and fetched from the keyring until
                        the token has expired. Use this option to request a
                        new token and replace the existing one in the keyring.
  --stale-duration <seconds>
                        Stale duration (in seconds) used to determine whether
                        a token has expired when retrieving it from keyring.
                        This is useful in mitigating process or network
                        delays. Default is 30 seconds.