diff --git a/scripts/arcanist.php b/scripts/arcanist.php
index b7f70f55..89b6d2c6 100755
--- a/scripts/arcanist.php
+++ b/scripts/arcanist.php
@@ -30,6 +30,11 @@ $base_args->parsePartial(
       'param'   => 'uri',
       'help'    => pht('Connect to Phabricator install specified by __uri__.'),
     ),
+    array(
+      'name' => 'conduit-token',
+      'param' => 'token',
+      'help' => pht('Use a specific authentication token.'),
+    ),
     array(
       'name'    => 'conduit-version',
       'param'   => 'version',
@@ -54,6 +59,7 @@ $base_args->parsePartial(
 $config_trace_mode = $base_args->getArg('trace');
 
 $force_conduit = $base_args->getArg('conduit-uri');
+$force_token = $base_args->getArg('conduit-token');
 $force_conduit_version = $base_args->getArg('conduit-version');
 $conduit_timeout = $base_args->getArg('conduit-timeout');
 $skip_arcconfig = $base_args->getArg('skip-arcconfig');
@@ -198,6 +204,9 @@ try {
   if ($force_conduit_version) {
     $workflow->forceConduitVersion($force_conduit_version);
   }
+  if ($force_token) {
+    $workflow->forceConduitToken($force_token);
+  }
   if ($conduit_timeout) {
     $workflow->setConduitTimeout($conduit_timeout);
   }
diff --git a/src/workflow/ArcanistHelpWorkflow.php b/src/workflow/ArcanistHelpWorkflow.php
index efed447c..0a4af166 100644
--- a/src/workflow/ArcanistHelpWorkflow.php
+++ b/src/workflow/ArcanistHelpWorkflow.php
@@ -189,6 +189,9 @@ EOTEXT
           Ignore configured Conduit URI and use an explicit one instead. Mostly
           useful for Arcanist development.
 
+      __--conduit-token__ __token__
+          Ignore configured credentials and use an explicit API token instead.
+
       __--conduit-version__ __version__
           Ignore software version and claim to be running some other version
           instead. Mostly useful for Arcanist development. May cause bad things
diff --git a/src/workflow/ArcanistWorkflow.php b/src/workflow/ArcanistWorkflow.php
index 77b859ec..ab90ed3d 100644
--- a/src/workflow/ArcanistWorkflow.php
+++ b/src/workflow/ArcanistWorkflow.php
@@ -48,6 +48,7 @@ abstract class ArcanistWorkflow extends Phobject {
   private $conduitCredentials;
   private $conduitAuthenticated;
   private $forcedConduitVersion;
+  private $forcedConduitToken;
   private $conduitTimeout;
 
   private $userPHID;
@@ -251,6 +252,21 @@ abstract class ArcanistWorkflow extends Phobject {
   }
 
 
+  /**
+   * Force use of a specific API token.
+   *
+   * Controlled by the --conduit-token flag.
+   *
+   * @param string API token to use.
+   * @return this
+   * @task conduit
+   */
+  final public function forceConduitToken($token) {
+    $this->forcedConduitToken = $token;
+    return $this;
+  }
+
+
   /**
    * Get the protocol version the client should identify with.
    *
@@ -325,10 +341,17 @@ abstract class ArcanistWorkflow extends Phobject {
       // If we have `token`, this server supports the simpler, new-style
       // token-based authentication. Use that instead of all the certificate
       // stuff.
+      $token = null;
       if (isset($credentials['token'])) {
+        $token = $credentials['token'];
+      }
+      if ($this->forcedConduitToken) {
+        $token = $this->forcedConduitToken;
+      }
+      if (strlen($token)) {
         $conduit = $this->getConduit();
 
-        $conduit->setConduitToken($credentials['token']);
+        $conduit->setConduitToken($token);
 
         try {
           $result = $this->getConduit()->callMethodSynchronous(