diff --git a/lib/ansible/config/base.yml b/lib/ansible/config/base.yml
index a5b32788708..a5a0c489279 100644
--- a/lib/ansible/config/base.yml
+++ b/lib/ansible/config/base.yml
@@ -1351,6 +1351,13 @@ GALAXY_TOKEN:
   ini:
   - {key: token, section: galaxy}
   yaml: {key: galaxy.token}
+GALAXY_TOKEN_PATH:
+  default: ~/.ansible/galaxy_token
+  description: "Local path to galaxy access token file"
+  env: [{name: ANSIBLE_GALAXY_TOKEN_PATH}]
+  ini:
+  - {key: token_path, section: galaxy}
+  type: path
 HOST_KEY_CHECKING:
   name: Check host keys
   default: True
diff --git a/lib/ansible/galaxy/api.py b/lib/ansible/galaxy/api.py
index d0298217354..5845ba6b45d 100644
--- a/lib/ansible/galaxy/api.py
+++ b/lib/ansible/galaxy/api.py
@@ -24,6 +24,8 @@ __metaclass__ = type
 
 import json
 
+from functools import wraps
+
 from ansible import context
 import ansible.constants as C
 from ansible.errors import AnsibleError
@@ -38,6 +40,16 @@ from ansible.utils.display import Display
 display = Display()
 
 
+def requires_token(func):
+    ''' wrapper to laziliy initialize token file '''
+    @wraps(func)
+    def wrapped(self, *args, **kwargs):
+        if self.token is None:
+            self.token = GalaxyToken()
+        return func(self, *args, **kwargs)
+    return wrapped
+
+
 def g_connect(method):
     ''' wrapper to lazily initialize connection info to galaxy '''
     def wrapped(self, *args, **kwargs):
@@ -62,7 +74,7 @@ class GalaxyAPI(object):
 
     def __init__(self, galaxy):
         self.galaxy = galaxy
-        self.token = GalaxyToken()
+        self.token = None
         self._api_server = C.GALAXY_SERVER
         self._validate_certs = not context.CLIARGS['ignore_certs']
         self.baseurl = None
@@ -75,6 +87,7 @@ class GalaxyAPI(object):
         if context.CLIARGS['api_server'] != C.GALAXY_SERVER:
             self._api_server = context.CLIARGS['api_server']
 
+    @requires_token
     def __auth_header(self):
         token = self.token.get()
         if token is None:
diff --git a/lib/ansible/galaxy/token.py b/lib/ansible/galaxy/token.py
index 4af7511b4cb..6c235ed652c 100644
--- a/lib/ansible/galaxy/token.py
+++ b/lib/ansible/galaxy/token.py
@@ -26,30 +26,37 @@ from stat import S_IRUSR, S_IWUSR
 
 import yaml
 
+from ansible import constants as C
+from ansible.module_utils._text import to_bytes, to_text
 from ansible.utils.display import Display
 
 display = Display()
 
 
 class GalaxyToken(object):
-    ''' Class to storing and retrieving token in ~/.ansible_galaxy '''
+    ''' Class to storing and retrieving local galaxy token '''
 
     def __init__(self):
-        self.file = os.path.expanduser("~") + '/.ansible_galaxy'
+        self.b_file = to_bytes(C.GALAXY_TOKEN_PATH)
         self.config = yaml.safe_load(self.__open_config_for_read())
         if not self.config:
             self.config = {}
 
     def __open_config_for_read(self):
-        if os.path.isfile(self.file):
-            display.vvv('Opened %s' % self.file)
-            return open(self.file, 'r')
-        # config.yml not found, create and chomd u+rw
-        f = open(self.file, 'w')
-        f.close()
-        os.chmod(self.file, S_IRUSR | S_IWUSR)  # owner has +rw
-        display.vvv('Created %s' % self.file)
-        return open(self.file, 'r')
+
+        f = None
+        action = 'Opened'
+        if not os.path.isfile(self.b_file):
+            # token file not found, create and chomd u+rw
+            f = open(self.b_file, 'w')
+            f.close()
+            os.chmod(self.b_file, S_IRUSR | S_IWUSR)  # owner has +rw
+            action = 'Created'
+
+        f = open(self.b_file, 'r')
+        display.vvv('%s %s' % (action, to_text(self.b_file)))
+
+        return f
 
     def set(self, token):
         self.config['token'] = token
@@ -59,5 +66,5 @@ class GalaxyToken(object):
         return self.config.get('token', None)
 
     def save(self):
-        with open(self.file, 'w') as f:
+        with open(self.b_file, 'w') as f:
             yaml.safe_dump(self.config, f, default_flow_style=False)