diff --git a/designate_tempest_plugin/clients.py b/designate_tempest_plugin/clients.py
index 9986a43..66db3de 100644
--- a/designate_tempest_plugin/clients.py
+++ b/designate_tempest_plugin/clients.py
@@ -42,6 +42,8 @@
     import TransferRequestClient
 from designate_tempest_plugin.services.dns.v2.json.transfer_accepts_client \
     import TransferAcceptClient
+from designate_tempest_plugin.services.dns.v2.json.tsigkey_client \
+    import TsigkeyClient
 
 CONF = config.CONF
 
@@ -100,3 +102,5 @@
                                            self.auth_provider, **params)
         self.transfer_accept_client = TransferAcceptClient(
                                            self.auth_provider, **params)
+        self.tsigkey_client = TsigkeyClient(
+                                           self.auth_provider, **params)
diff --git a/designate_tempest_plugin/data_utils.py b/designate_tempest_plugin/data_utils.py
index ae2b1a7..11113b8 100644
--- a/designate_tempest_plugin/data_utils.py
+++ b/designate_tempest_plugin/data_utils.py
@@ -233,3 +233,14 @@
         data['target_project_id'] = target_project_id
 
     return data
+
+
+def rand_tsig_algorithm():
+    algorithm = ['hmac-md5', 'hmac-sha1', 'hmac-sha224', 'hmac-sha256',
+                 'hmac-sha384', 'hmac-sha512']
+    return random.choice(algorithm)
+
+
+def rand_tsig_scope():
+    scope = ["ZONE", "POOL"]
+    return random.choice(scope)
diff --git a/designate_tempest_plugin/services/dns/v2/json/tsigkey_client.py b/designate_tempest_plugin/services/dns/v2/json/tsigkey_client.py
new file mode 100644
index 0000000..0c5f9c2
--- /dev/null
+++ b/designate_tempest_plugin/services/dns/v2/json/tsigkey_client.py
@@ -0,0 +1,108 @@
+# Copyright 2016 NEC Corporation.  All rights reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+from tempest.lib.common.utils import data_utils
+
+from designate_tempest_plugin import data_utils as utils
+from designate_tempest_plugin.services.dns.v2.json import base
+
+
+class TsigkeyClient(base.DnsClientV2Base):
+    """API V2 Tempest REST client for Designate Tsigkey API"""
+
+    @base.handle_errors
+    def create_tsigkey(self, resource_id, name=None, algorithm=None,
+                       secret=None, scope=None, params=None):
+        """Create a tsigkey with the specified parameters.
+        :param resource_id: Pool id or Zone id.
+        :param name: name of the tsigkey.
+        :param algorithm: TSIG algorithm e.g hmac-md5, hmac-sha256 etc.
+        :param secret: represents TSIG secret.
+        :param scope: represents TSIG scope.
+        :param params: A Python dict that represents the query paramaters to
+                       include in the request URI.
+        :return: A tuple with the server response and the created tsigkey.
+        """
+        tsig = {
+                 "name": name or data_utils.rand_name('test-tsig'),
+                 "algorithm": algorithm or utils.rand_tsig_algorithm(),
+                 "secret": secret or data_utils.rand_name("secret"),
+                 "scope": scope or utils.rand_tsig_scope(),
+                 "resource_id": resource_id}
+
+        resp, body = self._create_request('tsigkeys', object_dict=tsig,
+                                          params=params)
+
+        self.expected_success(201, resp.status)
+
+        return resp, body
+
+    @base.handle_errors
+    def list_tsigkeys(self, params=None):
+        """Gets a list of tsigkeys.
+        :param params: A Python dict that represents the query paramaters to
+                       include in the request URI.
+        :return: Serialized tsigkeys as a list.
+        """
+        return self._list_request('tsigkeys', params=params)
+
+    @base.handle_errors
+    def show_tsigkey(self, uuid, params=None):
+        """Gets a specific tsigkey.
+        :param uuid: Unique identifier of the tsigkey in UUID format.
+        :param params: A Python dict that represents the query paramaters to
+                       include in the request URI.
+        :return: Serialized tsigkey as a dictionary.
+        """
+        return self._show_request('tsigkeys', uuid, params=params)
+
+    @base.handle_errors
+    def update_tsigkey(self, uuid, name=None, algorithm=None,
+                       secret=None, scope=None, params=None):
+        """Update the tsigkey with the specified parameters.
+        :param uuid: The unique identifier of the tsigkey..
+        :param name: name of the tsigkey.
+        :param algorithm: TSIG algorithm e.g hmac-md5, hmac-sha256 etc.
+        :param secret: represents TSIG secret.
+        :param scope: represents TSIG scope.
+        :param params: A Python dict that represents the query paramaters to
+                       include in the request URI.
+        :return: A tuple with the server response and the updated tsigkey.
+        """
+        tsig = {
+                 "name": name or data_utils.rand_name('test-tsig'),
+                 "algorithm": algorithm or utils.rand_tsig_algorithm(),
+                 "secret": secret or data_utils.rand_name("secret"),
+                 "scope": scope or utils.rand_tsig_scope()}
+
+        resp, body = self._update_request('tsigkeys', uuid, tsig,
+                                          params=params)
+
+        self.expected_success(200, resp.status)
+
+        return resp, body
+
+    @base.handle_errors
+    def delete_tsigkey(self, uuid, params=None):
+        """Deletes a tsigkey having the specified UUID.
+        :param uuid: The unique identifier of the tsigkey.
+        :param params: A Python dict that represents the query paramaters to
+                       include in the request URI.
+        :return: A tuple with the server response and the response body.
+        """
+        resp, body = self._delete_request('tsigkeys', uuid, params=params)
+
+        self.expected_success(204, resp.status)
+
+        return resp, body
diff --git a/designate_tempest_plugin/tests/api/v2/test_tsigkey.py b/designate_tempest_plugin/tests/api/v2/test_tsigkey.py
new file mode 100644
index 0000000..750d3d4
--- /dev/null
+++ b/designate_tempest_plugin/tests/api/v2/test_tsigkey.py
@@ -0,0 +1,138 @@
+# Copyright 2016 NEC Corporation.  All rights reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+from oslo_log import log as logging
+from tempest import test
+from tempest.lib import decorators
+from tempest.lib import exceptions as lib_exc
+
+from designate_tempest_plugin.tests import base
+
+LOG = logging.getLogger(__name__)
+
+
+class BaseTsigkeyTest(base.BaseDnsV2Test):
+    excluded_keys = ['created_at', 'updated_at', 'links']
+
+
+class TsigkeyAdminTest(BaseTsigkeyTest):
+    credentials = ['primary', 'admin']
+
+    @classmethod
+    def setup_clients(cls):
+        super(TsigkeyAdminTest, cls).setup_clients()
+        cls.zone_client = cls.os.zones_client
+        cls.admin_client = cls.os_admin.tsigkey_client
+
+    @test.attr(type='smoke')
+    @decorators.idempotent_id('e7b484e3-7ed5-4840-89d7-1e696986f8e4')
+    def test_create_tsigkey(self):
+        LOG.info('Create a resource')
+        _, zone = self.zone_client.create_zone()
+        self.addCleanup(self.zone_client.delete_zone, zone['id'])
+
+        tsigkey_data = {
+                        "name": "Example tsigkey",
+                        "algorithm": "hmac-sha256",
+                        "secret": "SomeSecretKey",
+                        "scope": "POOL",
+                        "resource_id": zone['id']}
+
+        LOG.info('Create a tsigkey')
+        _, tsigkey = self.admin_client.create_tsigkey(
+                         tsigkey_data['resource_id'],
+                         tsigkey_data['name'], tsigkey_data['algorithm'],
+                         tsigkey_data['secret'], tsigkey_data['scope'])
+        self.addCleanup(self.admin_client.delete_tsigkey, tsigkey['id'])
+
+        self.assertEqual(tsigkey_data["name"], tsigkey['name'])
+
+    @test.attr(type='smoke')
+    @decorators.idempotent_id('d46e5e86-a18c-4315-aa0c-95a00e816fbf')
+    def test_list_tsigkey(self):
+        LOG.info('Create a resource')
+        _, zone = self.zone_client.create_zone()
+        self.addCleanup(self.zone_client.delete_zone, zone['id'])
+        LOG.info('Create a tsigkey')
+        _, tsigkey = self.admin_client.create_tsigkey(resource_id=zone['id'])
+        self.addCleanup(self.admin_client.delete_tsigkey, tsigkey['id'])
+        _, body = self.admin_client.list_tsigkeys()
+        self.assertGreater(len(body['tsigkeys']), 0)
+
+    @test.attr(type='smoke')
+    @decorators.idempotent_id('c5d7facf-0f05-47a2-a4fb-87f203860880')
+    def test_show_tsigkey(self):
+        LOG.info('Create a resource')
+        _, zone = self.zone_client.create_zone()
+        self.addCleanup(self.zone_client.delete_zone, zone['id'])
+
+        LOG.info('Create a tsigkey')
+        _, tsigkey = self.admin_client.create_tsigkey(resource_id=zone['id'])
+        self.addCleanup(self.admin_client.delete_tsigkey, tsigkey['id'])
+
+        LOG.info('Fetch the tsigkey')
+        _, body = self.admin_client.show_tsigkey(tsigkey['id'])
+
+        LOG.info('Ensure the fetched response matches the created tsigkey')
+        self.assertExpected(tsigkey, body, self.excluded_keys)
+
+    @test.attr(type='smoke')
+    @decorators.idempotent_id('d09dc0dd-dd72-41ee-9085-2afb2bf35459')
+    def test_update_tsigkey(self):
+        LOG.info('Create a resource')
+        _, zone = self.zone_client.create_zone()
+        self.addCleanup(self.zone_client.delete_zone, zone['id'])
+
+        LOG.info('Create a tsigkey')
+        _, tsigkey = self.admin_client.create_tsigkey(resource_id=zone['id'])
+        self.addCleanup(self.admin_client.delete_tsigkey, tsigkey['id'])
+
+        tsigkey_data = {
+                        "name": "Patch tsigkey",
+                        "secret": "NewSecretKey",
+                        "scope": "POOL"}
+
+        LOG.info('Update the tsigkey')
+        _, patch_tsigkey = self.admin_client.update_tsigkey(tsigkey['id'],
+                               name=tsigkey_data['name'],
+                               secret=tsigkey_data['secret'],
+                               scope=tsigkey_data['scope'])
+
+        self.assertEqual(tsigkey_data['name'], patch_tsigkey['name'])
+        self.assertEqual(tsigkey_data['secret'], patch_tsigkey['secret'])
+        self.assertEqual(tsigkey_data['scope'], patch_tsigkey['scope'])
+
+    @test.attr(type='smoke')
+    @decorators.idempotent_id('9cdffbd2-bc67-4a25-8eb7-4be8635c88a3')
+    def test_delete_tsigkey(self):
+        LOG.info('Create a resource')
+        _, zone = self.zone_client.create_zone()
+        self.addCleanup(self.zone_client.delete_zone, zone['id'])
+
+        LOG.info('Create a tsigkey')
+        _, tsigkey = self.admin_client.create_tsigkey(resource_id=zone['id'])
+
+        LOG.info('Delete the tsigkey')
+        _, body = self.admin_client.delete_tsigkey(tsigkey['id'])
+
+        self.assertRaises(lib_exc.NotFound,
+           lambda: self.admin_client.show_tsigkey(tsigkey['id']))
+
+    @test.attr(type='smoke')
+    @decorators.idempotent_id('4bdc20ef-96f9-47f6-a1aa-275159af326b')
+    def test_list_tsigkeys_dot_json_fails(self):
+        uri = self.admin_client.get_uri('tsigkeys.json')
+
+        self.assertRaises(lib_exc.NotFound,
+            lambda: self.admin_client.get(uri))