diff --git a/auth_options.go b/auth_options.go
new file mode 100644
index 0000000..f9e6ee5
--- /dev/null
+++ b/auth_options.go
@@ -0,0 +1,36 @@
+package gophercloud
+
+// AuthOptions lets anyone calling Authenticate() supply the required access credentials.
+// Its fields are the union of those recognized by each identity implementation and provider.
+type AuthOptions struct {
+
+	// IdentityEndpoint specifies the HTTP endpoint offering the Identity API of the appropriate version.
+	// Required by the identity services, but often populated by a provider Client.
+	IdentityEndpoint string
+
+	// Username is required if using Identity V2 API.
+	// Consult with your provider's control panel to discover your account's username.
+	// In Identity V3, either UserID or a combination of Username and DomainID or DomainName.
+	Username, UserID string
+
+	// Exactly one of Password or ApiKey is required for the Identity V2 and V3 APIs.
+	// Consult with your provider's control panel to discover your account's preferred method of authentication.
+	Password, APIKey string
+
+	// At most one of DomainID and DomainName must be provided if using Username with Identity V3.
+	// Otherwise, either are optional.
+	DomainID, DomainName string
+
+	// The TenantID and TenantName fields are optional for the Identity V2 API.
+	// Some providers allow you to specify a TenantName instead of the TenantId.
+	// Some require both.  Your provider's authentication policies will determine
+	// how these fields influence authentication.
+	TenantID, TenantName string
+
+	// AllowReauth should be set to true if you grant permission for Gophercloud to
+	// cache your credentials in memory, and to allow Gophercloud to attempt to
+	// re-authenticate automatically if/when your token expires.  If you set it to
+	// false, it will not cache these settings, but re-authentication will not be
+	// possible.  This setting defaults to false.
+	AllowReauth bool
+}
diff --git a/auth_results.go b/auth_results.go
new file mode 100644
index 0000000..c8e7a55
--- /dev/null
+++ b/auth_results.go
@@ -0,0 +1,11 @@
+package gophercloud
+
+// AuthResults encapsulates the raw results from an authentication request. As OpenStack allows
+// extensions to influence the structure returned in ways that Gophercloud cannot predict at
+// compile-time, you should use type-safe accessors to work with the data represented by this type,
+// such as ServiceCatalog() and TokenID().
+type AuthResults interface {
+
+	// Retrieve the authentication token's value from the authentication response.
+	GetTokenID() (string, error)
+}
diff --git a/service_client.go b/service_client.go
new file mode 100644
index 0000000..150da60
--- /dev/null
+++ b/service_client.go
@@ -0,0 +1,28 @@
+package gophercloud
+
+import (
+	"strings"
+)
+
+// ServiceClient stores details about a specific service that are necessary for further interactions
+// with that service API, as well as utility methods for service implementation.
+//
+// Generally, you will acquire a ServiceClient by calling the NewClient() function in the
+// appropriate service package.
+type ServiceClient struct {
+	authority AuthResults
+	options   AuthOptions
+	endpoint  string
+	tokenID   string
+}
+
+// ServiceURL constructs a URL for a resource belonging to this client.
+func (client *ServiceClient) ServiceURL(parts ...string) string {
+	return client.endpoint + strings.Join(parts, "/")
+}
+
+// AuthenticatedHeaders returns a map of HTTP headers that are common for all authenticated service
+// requests.
+func (client *ServiceClient) AuthenticatedHeaders() map[string]string {
+	return map[string]string{"X-Auth-Token": client.tokenID}
+}