diff --git a/openstack/identity/v2/tokens/requests_test.go b/openstack/identity/v2/tokens/requests_test.go
index fe71340..0e6269f 100644
--- a/openstack/identity/v2/tokens/requests_test.go
+++ b/openstack/identity/v2/tokens/requests_test.go
@@ -127,7 +127,7 @@
 		fmt.Fprintf(w, `{}`)
 	})
 
-	_, actualErr := Create(&client, options).ExtractToken()
+	actualErr := Create(&client, options).Err
 	th.CheckEquals(t, expectedErr, actualErr)
 }
 
@@ -216,3 +216,53 @@
     }
   `))
 }
+
+func TestProhibitUserID(t *testing.T) {
+	options := gophercloud.AuthOptions{
+		Username: "me",
+		UserID:   "1234",
+		Password: "thing",
+	}
+	tokenPostErr(t, options, ErrUserIDProvided)
+}
+
+func TestProhibitDomainID(t *testing.T) {
+	options := gophercloud.AuthOptions{
+		Username: "me",
+		Password: "thing",
+		DomainID: "1234",
+	}
+	tokenPostErr(t, options, ErrDomainIDProvided)
+}
+
+func TestProhibitDomainName(t *testing.T) {
+	options := gophercloud.AuthOptions{
+		Username:   "me",
+		Password:   "thing",
+		DomainName: "wat",
+	}
+	tokenPostErr(t, options, ErrDomainNameProvided)
+}
+
+func TestRequireUsername(t *testing.T) {
+	options := gophercloud.AuthOptions{
+		Password: "thing",
+	}
+	tokenPostErr(t, options, ErrUsernameRequired)
+}
+
+func TestProhibitBothPasswordAndAPIKey(t *testing.T) {
+	options := gophercloud.AuthOptions{
+		Username: "me",
+		Password: "thing",
+		APIKey:   "123412341234",
+	}
+	tokenPostErr(t, options, ErrPasswordOrAPIKey)
+}
+
+func TestRequirePasswordOrAPIKey(t *testing.T) {
+	options := gophercloud.AuthOptions{
+		Username: "me",
+	}
+	tokenPostErr(t, options, ErrPasswordOrAPIKey)
+}
diff --git a/openstack/identity/v2/tokens/results.go b/openstack/identity/v2/tokens/results.go
index 58dad77..e88b2c7 100644
--- a/openstack/identity/v2/tokens/results.go
+++ b/openstack/identity/v2/tokens/results.go
@@ -76,6 +76,10 @@
 
 // ExtractToken returns the just-created Token from a CreateResult.
 func (result CreateResult) ExtractToken() (*Token, error) {
+	if result.Err != nil {
+		return nil, result.Err
+	}
+
 	var response struct {
 		Access struct {
 			Token struct {
@@ -105,6 +109,10 @@
 
 // ExtractServiceCatalog returns the ServiceCatalog that was generated along with the user's Token.
 func (result CreateResult) ExtractServiceCatalog() (*ServiceCatalog, error) {
+	if result.Err != nil {
+		return nil, result.Err
+	}
+
 	var response struct {
 		Access struct {
 			Entries []CatalogEntry `mapstructure:"serviceCatalog"`