--- a/mozharness/mozilla/tooltool.py
+++ b/mozharness/mozilla/tooltool.py
@@ -1,10 +1,11 @@
 """module for tooltool operations"""
 import os
+import sys
 
 from mozharness.base.errors import PythonErrorList
 from mozharness.base.log import ERROR, FATAL
 from mozharness.mozilla.proxxy import Proxxy
 
 from mozharness.lib.python.authentication import get_credentials_path
 
 TooltoolErrorList = PythonErrorList + [{
@@ -18,18 +19,32 @@ TOOLTOOL_PY_URL = \
 TOOLTOOL_SERVERS = [
     'https://api.pub.build.mozilla.org/tooltool/',
 ]
 
 
 class TooltoolMixin(object):
     """Mixin class for handling tooltool manifests.
     To use a tooltool server other than the Mozilla server, override
-    config['tooltool_servers'].
+    config['tooltool_servers'].  To specify a different authentication
+    file than that used in releng automation,override
+    config['tooltool_authentication_file']; set it to None to not pass
+    any authentication information (OK for public files)
     """
+    def _get_auth_file(self):
+        # set the default authentication file based on platform; this
+        # corresponds to where puppet puts the token
+        if 'tooltool_authentication_file' in self.config:
+            return self.config['tooltool_authentication_file']
+
+        if self._is_windows():
+            return r'c:\builds\relengapi.tok'
+        else:
+            return '/builds/relengapi.tok'
+
     def tooltool_fetch(self, manifest, bootstrap_cmd=None,
                        output_dir=None, privileged=False, cache=None):
         """docstring for tooltool_fetch"""
         tooltool = self.query_exe('tooltool.py', return_type='list')
 
         if self.config.get("developer_mode"):
             if not os.path.exists(str(tooltool)):
                 tooltool = self._fetch_tooltool_py()
@@ -49,16 +64,21 @@ class TooltoolMixin(object):
 
         # proxxy-ify
         proxxy = Proxxy(self.config, self.log_obj)
         proxxy_urls = proxxy.get_proxies_and_urls(default_urls)
 
         for proxyied_url in proxxy_urls:
             cmd.extend(['--url', proxyied_url])
 
+        # handle authentication file, if given
+        auth_file = self._get_auth_file()
+        if auth_file:
+            cmd.extend(['--authentication-file', auth_file])
+
         cmd.extend(['fetch', '-m', manifest, '-o'])
 
         if cache:
             cmd.extend(['-c', cache])
 
         self.retry(
             self.run_command,
             args=(cmd, ),