diff --git a/scripts/arcanist.php b/scripts/arcanist.php
--- a/scripts/arcanist.php
+++ b/scripts/arcanist.php
@@ -31,6 +31,11 @@
       'help'    => pht('Connect to Phabricator install specified by __uri__.'),
     ),
     array(
+      'name' => 'conduit-token',
+      'param' => 'token',
+      'help' => pht('Use a specific authentication token.'),
+    ),
+    array(
       'name'    => 'conduit-version',
       'param'   => 'version',
       'help'    => pht(
@@ -54,6 +59,7 @@
 $config_trace_mode = $base_args->getArg('trace');
 
 $force_conduit = $base_args->getArg('conduit-uri');
+$force_token = $base_args->getArg('conduit-token');
 $force_conduit_version = $base_args->getArg('conduit-version');
 $conduit_timeout = $base_args->getArg('conduit-timeout');
 $skip_arcconfig = $base_args->getArg('skip-arcconfig');
@@ -198,6 +204,9 @@
   if ($force_conduit_version) {
     $workflow->forceConduitVersion($force_conduit_version);
   }
+  if ($force_token) {
+    $workflow->forceConduitToken($force_token);
+  }
   if ($conduit_timeout) {
     $workflow->setConduitTimeout($conduit_timeout);
   }
diff --git a/src/workflow/ArcanistHelpWorkflow.php b/src/workflow/ArcanistHelpWorkflow.php
--- a/src/workflow/ArcanistHelpWorkflow.php
+++ b/src/workflow/ArcanistHelpWorkflow.php
@@ -189,6 +189,9 @@
           Ignore configured Conduit URI and use an explicit one instead. Mostly
           useful for Arcanist development.
 
+      __--conduit-token__ __token__
+          Ignore configured credentials and use an explicit API token instead.
+
       __--conduit-version__ __version__
           Ignore software version and claim to be running some other version
           instead. Mostly useful for Arcanist development. May cause bad things
diff --git a/src/workflow/ArcanistWorkflow.php b/src/workflow/ArcanistWorkflow.php
--- a/src/workflow/ArcanistWorkflow.php
+++ b/src/workflow/ArcanistWorkflow.php
@@ -48,6 +48,7 @@
   private $conduitCredentials;
   private $conduitAuthenticated;
   private $forcedConduitVersion;
+  private $forcedConduitToken;
   private $conduitTimeout;
 
   private $userPHID;
@@ -252,6 +253,21 @@
 
 
   /**
+   * Force use of a specific API token.
+   *
+   * Controlled by the --conduit-token flag.
+   *
+   * @param string API token to use.
+   * @return this
+   * @task conduit
+   */
+  final public function forceConduitToken($token) {
+    $this->forcedConduitToken = $token;
+    return $this;
+  }
+
+
+  /**
    * Get the protocol version the client should identify with.
    *
    * @return int Version the client should claim to be.
@@ -325,10 +341,17 @@
       // If we have `token`, this server supports the simpler, new-style
       // token-based authentication. Use that instead of all the certificate
       // stuff.
+      $token = null;
       if (isset($credentials['token'])) {
+        $token = $credentials['token'];
+      }
+      if ($this->forcedConduitToken) {
+        $token = $this->forcedConduitToken;
+      }
+      if (strlen($token)) {
         $conduit = $this->getConduit();
 
-        $conduit->setConduitToken($credentials['token']);
+        $conduit->setConduitToken($token);
 
         try {
           $result = $this->getConduit()->callMethodSynchronous(