diff --git a/cmd/terraform-provider-route/main.go b/cmd/terraform-provider-route/main.go
index 635cd84..01e56b3 100644
--- a/cmd/terraform-provider-route/main.go
+++ b/cmd/terraform-provider-route/main.go
@@ -4,7 +4,6 @@ import (
 	"crypto/tls"
 	"log"
 
-	proto "git.xeserv.us/xena/route/proto"
 	jwtcreds "github.com/Xe/x/tools/svc/credentials/jwt"
 	"github.com/hashicorp/terraform/helper/schema"
 	"github.com/hashicorp/terraform/plugin"
@@ -43,6 +42,7 @@ func provider() terraform.ResourceProvider {
 
 		ResourcesMap: map[string]*schema.Resource{
 			"route_route": routeResource(),
+			"route_token": tokenResource(),
 		},
 
 		ConfigureFunc: providerConfigure,
@@ -67,7 +67,5 @@ func providerConfigure(d *schema.ResourceData) (interface{}, error) {
 		return nil, err
 	}
 
-	rc := proto.NewRoutesClient(conn)
-
-	return rc, nil
+	return conn, nil
 }
diff --git a/cmd/terraform-provider-route/route.go b/cmd/terraform-provider-route/route.go
index 6a0def2..cf654c2 100644
--- a/cmd/terraform-provider-route/route.go
+++ b/cmd/terraform-provider-route/route.go
@@ -6,6 +6,7 @@ import (
 
 	proto "git.xeserv.us/xena/route/proto"
 	"github.com/hashicorp/terraform/helper/schema"
+	"google.golang.org/grpc"
 )
 
 func routeResource() *schema.Resource {
@@ -30,7 +31,7 @@ func routeResource() *schema.Resource {
 }
 
 func resourceRouteCreate(d *schema.ResourceData, meta interface{}) error {
-	cli := meta.(proto.RoutesClient)
+	cli := proto.NewRoutesClient(meta.(*grpc.ClientConn))
 
 	rt, err := cli.Put(context.Background(), &proto.Route{
 		Host: d.Get("host").(string),
@@ -46,7 +47,7 @@ func resourceRouteCreate(d *schema.ResourceData, meta interface{}) error {
 }
 
 func resourceRouteDelete(d *schema.ResourceData, meta interface{}) error {
-	cli := meta.(proto.RoutesClient)
+	cli := proto.NewRoutesClient(meta.(*grpc.ClientConn))
 
 	rt, err := cli.Get(context.Background(), &proto.GetRouteRequest{Id: d.Id()})
 	if err != nil {
@@ -64,7 +65,7 @@ func resourceRouteDelete(d *schema.ResourceData, meta interface{}) error {
 }
 
 func resourceRouteExists(d *schema.ResourceData, meta interface{}) (bool, error) {
-	cli := meta.(proto.RoutesClient)
+	cli := proto.NewRoutesClient(meta.(*grpc.ClientConn))
 
 	_, err := cli.Get(context.Background(), &proto.GetRouteRequest{Id: d.Id()})
 	if err != nil {
@@ -75,7 +76,7 @@ func resourceRouteExists(d *schema.ResourceData, meta interface{}) (bool, error)
 }
 
 func resourceRouteRead(d *schema.ResourceData, meta interface{}) error {
-	cli := meta.(proto.RoutesClient)
+	cli := proto.NewRoutesClient(meta.(*grpc.ClientConn))
 
 	rt, err := cli.Get(context.Background(), &proto.GetRouteRequest{Id: d.Id()})
 	if err != nil {
diff --git a/cmd/terraform-provider-route/token.go b/cmd/terraform-provider-route/token.go
new file mode 100644
index 0000000..5058f59
--- /dev/null
+++ b/cmd/terraform-provider-route/token.go
@@ -0,0 +1,99 @@
+package main
+
+import (
+	"context"
+	"log"
+
+	proto "git.xeserv.us/xena/route/proto"
+	"github.com/hashicorp/terraform/helper/schema"
+	"google.golang.org/grpc"
+)
+
+func tokenResource() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceTokenCreate,
+		Read:   resourceTokenRead,
+		Delete: resourceTokenDelete,
+		Exists: resourceTokenExists,
+
+		Importer: &schema.ResourceImporter{
+			State: schema.ImportStatePassthrough,
+		},
+
+		Schema: map[string]*schema.Schema{
+			"scopes": {
+				Type:     schema.TypeList,
+				Required: true,
+				ForceNew: true,
+			},
+		},
+	}
+}
+
+func resourceTokenCreate(d *schema.ResourceData, meta interface{}) error {
+	cli := proto.NewTokensClient(meta.(*grpc.ClientConn))
+
+	var scps []string
+
+	for _, val := range d.Get("scopes").([]interface{}) {
+		sc, ok := val.(string)
+		if !ok {
+			log.Printf("[INFO] can't decode %#v", sc)
+			continue
+		}
+
+		scps = append(scps, sc)
+	}
+
+	tok, err := cli.Put(context.Background(), &proto.Token{Scopes: scps})
+	if err != nil {
+		return err
+	}
+
+	log.Printf("[INFO] created token with scopes %v and ID %s", tok.Scopes, tok.Id)
+
+	return nil
+}
+
+func resourceTokenDelete(d *schema.ResourceData, meta interface{}) error {
+	cli := proto.NewTokensClient(meta.(*grpc.ClientConn))
+
+	tok, err := cli.Get(context.Background(), &proto.GetTokenRequest{Id: d.Id()})
+	if err != nil {
+		return err
+	}
+
+	_, err = cli.Deactivate(context.Background(), tok)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func resourceTokenExists(d *schema.ResourceData, meta interface{}) (bool, error) {
+	cli := proto.NewTokensClient(meta.(*grpc.ClientConn))
+
+	_, err := cli.Get(context.Background(), &proto.GetTokenRequest{Id: d.Id()})
+	if err != nil {
+		return false, err
+	}
+
+	return true, nil
+}
+
+func resourceTokenRead(d *schema.ResourceData, meta interface{}) error {
+	cli := proto.NewTokensClient(meta.(*grpc.ClientConn))
+
+	tok, err := cli.Get(context.Background(), &proto.GetTokenRequest{Id: d.Id()})
+	if err != nil {
+		return err
+	}
+
+	d.SetId(tok.Id)
+	d.Set("body", tok.Body)
+	d.Set("active", tok.Active)
+	d.Set("scopes", tok.Scopes)
+
+	return nil
+}