diff --git a/pom.xml b/pom.xml
index bcf7dae69..21e906348 100644
--- a/pom.xml
+++ b/pom.xml
@@ -61,7 +61,8 @@
   <properties>
     <scalecube-cluster.version>2.6.7.RC1</scalecube-cluster.version>
     <scalecube-commons.version>1.0.13</scalecube-commons.version>
-    <scalecube-security-tokens.version>1.0.16</scalecube-security-tokens.version>
+    <scalecube-security-tokens.version>1.0.18</scalecube-security-tokens.version>
+    <scalecube-config.version>0.4.15</scalecube-config.version>
 
     <reactor.version>2020.0.5</reactor.version>
     <jackson.version>2.11.0</jackson.version>
@@ -71,6 +72,7 @@
     <log4j.version>2.13.2</log4j.version>
     <disruptor.version>3.4.2</disruptor.version>
     <netty.version>4.1.60.Final</netty.version>
+    <snakeyaml.version>1.26</snakeyaml.version>
 
     <jsr305.version>3.0.2</jsr305.version>
     <jctools.version>2.1.2</jctools.version>
@@ -85,7 +87,7 @@
     <module>services-transport-parent</module>
     <module>services-discovery</module>
     <module>services-bytebuf-codec</module>
-    <module>services-security</module>
+    <module>services-security-parent</module>
     <module>services-examples</module>
   </modules>
 
@@ -106,6 +108,13 @@
         <version>${scalecube-security-tokens.version}</version>
       </dependency>
 
+      <!-- Scalecube config -->
+      <dependency>
+        <groupId>io.scalecube</groupId>
+        <artifactId>config-vault</artifactId>
+        <version>${scalecube-config.version}</version>
+      </dependency>
+
       <!-- Scalecube cluster -->
       <dependency>
         <groupId>io.scalecube</groupId>
@@ -206,6 +215,13 @@
         <artifactId>netty-common</artifactId>
         <version>${netty.version}</version>
       </dependency>
+
+      <!-- Yaml -->
+      <dependency>
+        <groupId>org.yaml</groupId>
+        <artifactId>snakeyaml</artifactId>
+        <version>${snakeyaml.version}</version>
+      </dependency>
     </dependencies>
   </dependencyManagement>
 
diff --git a/services-security-parent/pom.xml b/services-security-parent/pom.xml
new file mode 100644
index 000000000..42d197147
--- /dev/null
+++ b/services-security-parent/pom.xml
@@ -0,0 +1,21 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+  xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+  <modelVersion>4.0.0</modelVersion>
+
+  <parent>
+    <groupId>io.scalecube</groupId>
+    <artifactId>scalecube-services-parent</artifactId>
+    <version>2.10.13-SNAPSHOT</version>
+  </parent>
+
+  <artifactId>scalecube-services-security-parent</artifactId>
+  <packaging>pom</packaging>
+
+  <modules>
+    <module>services-security</module>
+    <module>services-security-vault</module>
+  </modules>
+
+</project>
diff --git a/services-security-parent/services-security-vault/pom.xml b/services-security-parent/services-security-vault/pom.xml
new file mode 100644
index 000000000..5e1caf63d
--- /dev/null
+++ b/services-security-parent/services-security-vault/pom.xml
@@ -0,0 +1,37 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+  xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+  <modelVersion>4.0.0</modelVersion>
+
+  <parent>
+    <groupId>io.scalecube</groupId>
+    <artifactId>scalecube-services-security-parent</artifactId>
+    <version>2.10.13-SNAPSHOT</version>
+  </parent>
+
+  <artifactId>scalecube-services-security-vault</artifactId>
+
+  <dependencies>
+    <dependency>
+      <groupId>io.scalecube</groupId>
+      <artifactId>scalecube-services</artifactId>
+      <version>${project.version}</version>
+    </dependency>
+    <dependency>
+      <groupId>io.scalecube</groupId>
+      <artifactId>scalecube-services-security</artifactId>
+      <version>${project.version}</version>
+    </dependency>
+    <!-- Other -->
+    <dependency>
+      <groupId>io.scalecube</groupId>
+      <artifactId>config-vault</artifactId>
+    </dependency>
+    <dependency>
+      <groupId>org.yaml</groupId>
+      <artifactId>snakeyaml</artifactId>
+    </dependency>
+  </dependencies>
+
+</project>
diff --git a/services-security-parent/services-security-vault/src/main/java/io/scalecube/services/security/vault/VaultServiceRolesInstaller.java b/services-security-parent/services-security-vault/src/main/java/io/scalecube/services/security/vault/VaultServiceRolesInstaller.java
new file mode 100644
index 000000000..a1c12b5ec
--- /dev/null
+++ b/services-security-parent/services-security-vault/src/main/java/io/scalecube/services/security/vault/VaultServiceRolesInstaller.java
@@ -0,0 +1,307 @@
+package io.scalecube.services.security.vault;
+
+import com.bettercloud.vault.json.Json;
+import com.bettercloud.vault.rest.Rest;
+import com.bettercloud.vault.rest.RestException;
+import io.scalecube.services.security.vault.VaultServiceRolesInstaller.ServiceRoles.Role;
+import java.io.InputStream;
+import java.util.Base64;
+import java.util.List;
+import java.util.Objects;
+import java.util.StringJoiner;
+import java.util.function.Function;
+import java.util.function.Supplier;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.yaml.snakeyaml.Yaml;
+import org.yaml.snakeyaml.constructor.Constructor;
+import reactor.core.Exceptions;
+
+public final class VaultServiceRolesInstaller {
+
+  private static final Logger LOGGER = LoggerFactory.getLogger(VaultServiceRolesInstaller.class);
+
+  private static final String VAULT_TOKEN_HEADER = "X-Vault-Token";
+
+  private String vaultAddress;
+  private Supplier<String> vaultTokenSupplier;
+  private Supplier<String> keyNameSupplier;
+  private Function<String, String> roleNameBuilder;
+  private String inputFileName = "service-roles.yaml";
+  private String keyAlgorithm = "RS256";
+  private String keyRotationPeriod = "1h";
+  private String keyVerificationTtl = "1h";
+  private String roleTtl = "1m";
+
+  public VaultServiceRolesInstaller() {}
+
+  private VaultServiceRolesInstaller(VaultServiceRolesInstaller other) {
+    this.vaultAddress = other.vaultAddress;
+    this.vaultTokenSupplier = other.vaultTokenSupplier;
+    this.keyNameSupplier = other.keyNameSupplier;
+    this.roleNameBuilder = other.roleNameBuilder;
+    this.inputFileName = other.inputFileName;
+    this.keyAlgorithm = other.keyAlgorithm;
+    this.keyRotationPeriod = other.keyRotationPeriod;
+    this.keyVerificationTtl = other.keyVerificationTtl;
+    this.roleTtl = other.roleTtl;
+  }
+
+  /**
+   * Setter for vaultAddress.
+   *
+   * @param vaultAddress vaultAddress
+   * @return new instance with applied setting
+   */
+  public VaultServiceRolesInstaller vaultAddress(String vaultAddress) {
+    final VaultServiceRolesInstaller c = copy();
+    c.vaultAddress = vaultAddress;
+    return c;
+  }
+
+  /**
+   * Setter for vaultTokenSupplier.
+   *
+   * @param vaultTokenSupplier vaultTokenSupplier
+   * @return new instance with applied setting
+   */
+  public VaultServiceRolesInstaller vaultTokenSupplier(Supplier<String> vaultTokenSupplier) {
+    final VaultServiceRolesInstaller c = copy();
+    c.vaultTokenSupplier = vaultTokenSupplier;
+    return c;
+  }
+
+  /**
+   * Setter for keyNameSupplier.
+   *
+   * @param keyNameSupplier keyNameSupplier
+   * @return new instance with applied setting
+   */
+  public VaultServiceRolesInstaller keyNameSupplier(Supplier<String> keyNameSupplier) {
+    final VaultServiceRolesInstaller c = copy();
+    c.keyNameSupplier = keyNameSupplier;
+    return c;
+  }
+
+  /**
+   * Setter for roleNameBuilder.
+   *
+   * @param roleNameBuilder roleNameBuilder
+   * @return new instance with applied setting
+   */
+  public VaultServiceRolesInstaller roleNameBuilder(Function<String, String> roleNameBuilder) {
+    final VaultServiceRolesInstaller c = copy();
+    c.roleNameBuilder = roleNameBuilder;
+    return c;
+  }
+
+  /**
+   * Setter for inputFileName.
+   *
+   * @param inputFileName inputFileName
+   * @return new instance with applied setting
+   */
+  public VaultServiceRolesInstaller inputFileName(String inputFileName) {
+    final VaultServiceRolesInstaller c = copy();
+    c.inputFileName = inputFileName;
+    return c;
+  }
+
+  /**
+   * Setter for keyAlgorithm.
+   *
+   * @param keyAlgorithm keyAlgorithm
+   * @return new instance with applied setting
+   */
+  public VaultServiceRolesInstaller keyAlgorithm(String keyAlgorithm) {
+    final VaultServiceRolesInstaller c = copy();
+    c.keyAlgorithm = keyAlgorithm;
+    return c;
+  }
+
+  /**
+   * Setter for keyRotationPeriod.
+   *
+   * @param keyRotationPeriod keyRotationPeriod
+   * @return new instance with applied setting
+   */
+  public VaultServiceRolesInstaller keyRotationPeriod(String keyRotationPeriod) {
+    final VaultServiceRolesInstaller c = copy();
+    c.keyRotationPeriod = keyRotationPeriod;
+    return c;
+  }
+
+  /**
+   * Setter for keyVerificationTtl.
+   *
+   * @param keyVerificationTtl keyVerificationTtl
+   * @return new instance with applied setting
+   */
+  public VaultServiceRolesInstaller keyVerificationTtl(String keyVerificationTtl) {
+    final VaultServiceRolesInstaller c = copy();
+    c.keyVerificationTtl = keyVerificationTtl;
+    return c;
+  }
+
+  /**
+   * Setter for roleTtl.
+   *
+   * @param roleTtl roleTtl
+   * @return new instance with applied setting
+   */
+  public VaultServiceRolesInstaller roleTtl(String roleTtl) {
+    final VaultServiceRolesInstaller c = copy();
+    c.roleTtl = roleTtl;
+    return c;
+  }
+
+  /**
+   * Reads {@code serviceRolesFileName (access-file.yaml)} and builds micro-infrastructure for
+   * machine-to-machine authentication in the vault.
+   */
+  public void install() {
+    if (isNullOrNoneOrEmpty(vaultAddress)) {
+      return;
+    }
+
+    final ServiceRoles serviceRoles = loadServiceRoles();
+    if (serviceRoles == null) {
+      return;
+    }
+
+    final Rest rest = new Rest().header(VAULT_TOKEN_HEADER, vaultTokenSupplier.get());
+
+    if (!serviceRoles.roles.isEmpty()) {
+      String keyName = keyNameSupplier.get();
+      createVaultIdentityKey(keyName, () -> rest.url(buildVaultIdentityKeyUri(keyName)));
+
+      for (Role role : serviceRoles.roles) {
+        String roleName = roleNameBuilder.apply(role.role);
+        createVaultIdentityRole(
+            keyName,
+            roleName,
+            role.permissions,
+            () -> rest.url(buildVaultIdentityRoleUri(roleName)));
+      }
+    }
+  }
+
+  private ServiceRoles loadServiceRoles() {
+    ClassLoader classLoader = Thread.currentThread().getContextClassLoader();
+    InputStream inputStream = classLoader.getResourceAsStream(inputFileName);
+    return inputStream != null
+        ? new Yaml(new Constructor(ServiceRoles.class)).load(inputStream)
+        : null;
+  }
+
+  private static void verifyOk(int status, String operation) {
+    if (status != 200 && status != 204) {
+      LOGGER.error("Not expected status ({}) returned on [{}]", status, operation);
+      throw new IllegalStateException("Not expected status returned, status=" + status);
+    }
+  }
+
+  private void createVaultIdentityKey(String keyName, Supplier<Rest> restSupplier) {
+    LOGGER.debug("[createVaultIdentityKey] {}", keyName);
+
+    byte[] body =
+        Json.object()
+            .add("rotation_period", keyRotationPeriod)
+            .add("verification_ttl", keyVerificationTtl)
+            .add("allowed_client_ids", "*")
+            .add("algorithm", keyAlgorithm)
+            .toString()
+            .getBytes();
+
+    try {
+      verifyOk(restSupplier.get().body(body).post().getStatus(), "createVaultIdentityKey");
+    } catch (RestException e) {
+      throw Exceptions.propagate(e);
+    }
+  }
+
+  private void createVaultIdentityRole(
+      String keyName, String roleName, List<String> permissions, Supplier<Rest> restSupplier) {
+    LOGGER.debug("[createVaultIdentityRole] {}", roleName);
+
+    byte[] body =
+        Json.object()
+            .add("key", keyName)
+            .add("template", createTemplate(permissions))
+            .add("ttl", roleTtl)
+            .toString()
+            .getBytes();
+
+    try {
+      verifyOk(restSupplier.get().body(body).post().getStatus(), "createVaultIdentityRole");
+    } catch (RestException e) {
+      throw Exceptions.propagate(e);
+    }
+  }
+
+  private static String createTemplate(List<String> permissions) {
+    return Base64.getUrlEncoder()
+        .encodeToString(
+            Json.object().add("permissions", String.join(",", permissions)).toString().getBytes());
+  }
+
+  private String buildVaultIdentityKeyUri(String keyName) {
+    return new StringJoiner("/", vaultAddress, "")
+        .add("v1/identity/oidc/key")
+        .add(keyName)
+        .toString();
+  }
+
+  private String buildVaultIdentityRoleUri(String roleName) {
+    return new StringJoiner("/", vaultAddress, "")
+        .add("v1/identity/oidc/role")
+        .add(roleName)
+        .toString();
+  }
+
+  private VaultServiceRolesInstaller copy() {
+    return new VaultServiceRolesInstaller(this);
+  }
+
+  private static boolean isNullOrNoneOrEmpty(String value) {
+    return Objects.isNull(value)
+        || "none".equalsIgnoreCase(value)
+        || "null".equals(value)
+        || value.isEmpty();
+  }
+
+  public static class ServiceRoles {
+
+    private List<Role> roles;
+
+    public List<Role> getRoles() {
+      return roles;
+    }
+
+    public void setRoles(List<Role> roles) {
+      this.roles = roles;
+    }
+
+    public static class Role {
+
+      private String role;
+      private List<String> permissions;
+
+      public String getRole() {
+        return role;
+      }
+
+      public void setRole(String role) {
+        this.role = role;
+      }
+
+      public List<String> getPermissions() {
+        return permissions;
+      }
+
+      public void setPermissions(List<String> permissions) {
+        this.permissions = permissions;
+      }
+    }
+  }
+}
diff --git a/services-security-parent/services-security-vault/src/main/java/io/scalecube/services/security/vault/VaultServiceTokenCredentialsSupplier.java b/services-security-parent/services-security-vault/src/main/java/io/scalecube/services/security/vault/VaultServiceTokenCredentialsSupplier.java
new file mode 100644
index 000000000..1121be769
--- /dev/null
+++ b/services-security-parent/services-security-vault/src/main/java/io/scalecube/services/security/vault/VaultServiceTokenCredentialsSupplier.java
@@ -0,0 +1,147 @@
+package io.scalecube.services.security.vault;
+
+import com.bettercloud.vault.json.Json;
+import com.bettercloud.vault.rest.Rest;
+import com.bettercloud.vault.rest.RestException;
+import com.bettercloud.vault.rest.RestResponse;
+import io.scalecube.services.ServiceReference;
+import io.scalecube.services.auth.CredentialsSupplier;
+import io.scalecube.services.security.ServiceTokens;
+import io.scalecube.utils.MaskUtil;
+import java.util.Collections;
+import java.util.Map;
+import java.util.StringJoiner;
+import java.util.function.BiFunction;
+import java.util.function.Supplier;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import reactor.core.Exceptions;
+import reactor.core.publisher.Mono;
+
+public final class VaultServiceTokenCredentialsSupplier implements CredentialsSupplier {
+
+  private static final Logger LOGGER =
+      LoggerFactory.getLogger(VaultServiceTokenCredentialsSupplier.class);
+
+  private static final String VAULT_TOKEN_HEADER = "X-Vault-Token";
+
+  private String serviceRole;
+  private String vaultAddress;
+  private Supplier<String> vaultTokenSupplier;
+  private BiFunction<String, Map<String, String>, String> serviceTokenNameBuilder;
+
+  public VaultServiceTokenCredentialsSupplier() {}
+
+  private VaultServiceTokenCredentialsSupplier(VaultServiceTokenCredentialsSupplier other) {
+    this.serviceRole = other.serviceRole;
+    this.vaultAddress = other.vaultAddress;
+    this.vaultTokenSupplier = other.vaultTokenSupplier;
+    this.serviceTokenNameBuilder = other.serviceTokenNameBuilder;
+  }
+
+  /**
+   * Setter for serviceRole.
+   *
+   * @param serviceRole serviceRole
+   * @return new instance with applied setting
+   */
+  public VaultServiceTokenCredentialsSupplier serviceRole(String serviceRole) {
+    final VaultServiceTokenCredentialsSupplier c = copy();
+    c.serviceRole = serviceRole;
+    return c;
+  }
+
+  /**
+   * Setter for vaultAddress.
+   *
+   * @param vaultAddress vaultAddress
+   * @return new instance with applied setting
+   */
+  public VaultServiceTokenCredentialsSupplier vaultAddress(String vaultAddress) {
+    final VaultServiceTokenCredentialsSupplier c = copy();
+    c.vaultAddress = vaultAddress;
+    return c;
+  }
+
+  /**
+   * Setter for vaultTokenSupplier.
+   *
+   * @param vaultTokenSupplier vaultTokenSupplier
+   * @return new instance with applied setting
+   */
+  public VaultServiceTokenCredentialsSupplier vaultTokenSupplier(
+      Supplier<String> vaultTokenSupplier) {
+    final VaultServiceTokenCredentialsSupplier c = copy();
+    c.vaultTokenSupplier = vaultTokenSupplier;
+    return c;
+  }
+
+  /**
+   * Setter for serviceTokenNameBuilder.
+   *
+   * @param serviceTokenNameBuilder serviceTokenNameBuilder
+   * @return new instance with applied setting
+   */
+  public VaultServiceTokenCredentialsSupplier serviceTokenNameBuilder(
+      BiFunction<String, Map<String, String>, String> serviceTokenNameBuilder) {
+    final VaultServiceTokenCredentialsSupplier c = copy();
+    c.serviceTokenNameBuilder = serviceTokenNameBuilder;
+    return c;
+  }
+
+  @Override
+  public Mono<Map<String, String>> apply(ServiceReference serviceReference) {
+    return Mono.fromCallable(vaultTokenSupplier::get)
+        .map(vaultToken -> rpcGetServiceToken(serviceReference.tags(), vaultToken))
+        .doOnNext(response -> verifyOk(response.getStatus()))
+        .map(this::toCredentials)
+        .doOnSuccess(
+            creds ->
+                LOGGER.info(
+                    "[rpcGetServiceToken] Successfully obtained vault service token: {}",
+                    MaskUtil.mask(creds)));
+  }
+
+  private Map<String, String> toCredentials(RestResponse response) {
+    return Collections.singletonMap(
+        ServiceTokens.SERVICE_TOKEN_HEADER,
+        Json.parse(new String(response.getBody()))
+            .asObject()
+            .get("data")
+            .asObject()
+            .get("token")
+            .asString());
+  }
+
+  private RestResponse rpcGetServiceToken(Map<String, String> tags, String vaultToken) {
+    String uri = buildVaultServiceTokenUri(tags);
+    LOGGER.info("[rpcGetServiceToken] Getting vault service token (uri='{}')", uri);
+    try {
+      return new Rest().header(VAULT_TOKEN_HEADER, vaultToken).url(uri).get();
+    } catch (RestException e) {
+      LOGGER.error(
+          "[rpcGetServiceToken] Failed to get vault service token (uri='{}'), cause: {}",
+          uri,
+          e.toString());
+      throw Exceptions.propagate(e);
+    }
+  }
+
+  private static void verifyOk(int status) {
+    if (status != 200) {
+      LOGGER.error("[rpcGetServiceToken] Not expected status ({}) returned", status);
+      throw new IllegalStateException("Not expected status returned, status=" + status);
+    }
+  }
+
+  private String buildVaultServiceTokenUri(Map<String, String> tags) {
+    return new StringJoiner("/", vaultAddress, "")
+        .add("v1/identity/oidc/token")
+        .add(serviceTokenNameBuilder.apply(serviceRole, tags))
+        .toString();
+  }
+
+  private VaultServiceTokenCredentialsSupplier copy() {
+    return new VaultServiceTokenCredentialsSupplier(this);
+  }
+}
diff --git a/services-security/pom.xml b/services-security-parent/services-security/pom.xml
similarity index 90%
rename from services-security/pom.xml
rename to services-security-parent/services-security/pom.xml
index 737f90ac1..5c3ec8cf4 100644
--- a/services-security/pom.xml
+++ b/services-security-parent/services-security/pom.xml
@@ -6,7 +6,7 @@
 
   <parent>
     <groupId>io.scalecube</groupId>
-    <artifactId>scalecube-services-parent</artifactId>
+    <artifactId>scalecube-services-security-parent</artifactId>
     <version>2.10.13-SNAPSHOT</version>
   </parent>
 
@@ -18,6 +18,7 @@
       <artifactId>scalecube-services</artifactId>
       <version>${project.version}</version>
     </dependency>
+    <!-- Other -->
     <dependency>
       <groupId>io.scalecube</groupId>
       <artifactId>scalecube-security-tokens</artifactId>
diff --git a/services-security/src/main/java/io/scalecube/services/security/CompositeAuthenticator.java b/services-security-parent/services-security/src/main/java/io/scalecube/services/security/CompositeAuthenticator.java
similarity index 100%
rename from services-security/src/main/java/io/scalecube/services/security/CompositeAuthenticator.java
rename to services-security-parent/services-security/src/main/java/io/scalecube/services/security/CompositeAuthenticator.java
diff --git a/services-security/src/main/java/io/scalecube/services/security/Credentials.java b/services-security-parent/services-security/src/main/java/io/scalecube/services/security/Credentials.java
similarity index 97%
rename from services-security/src/main/java/io/scalecube/services/security/Credentials.java
rename to services-security-parent/services-security/src/main/java/io/scalecube/services/security/Credentials.java
index 4826f8c1f..9e9d83ea9 100644
--- a/services-security/src/main/java/io/scalecube/services/security/Credentials.java
+++ b/services-security-parent/services-security/src/main/java/io/scalecube/services/security/Credentials.java
@@ -15,6 +15,10 @@
 
 public class Credentials {
 
+  private Credentials() {
+    // Do not instantiate
+  }
+
   /**
    * Encodes the given credentials to the given stream.
    *
diff --git a/services-security-parent/services-security/src/main/java/io/scalecube/services/security/RetryStrategies.java b/services-security-parent/services-security/src/main/java/io/scalecube/services/security/RetryStrategies.java
new file mode 100644
index 000000000..0de36f483
--- /dev/null
+++ b/services-security-parent/services-security/src/main/java/io/scalecube/services/security/RetryStrategies.java
@@ -0,0 +1,53 @@
+package io.scalecube.services.security;
+
+import io.scalecube.security.tokens.jwt.KeyNotFoundException;
+import java.time.Duration;
+import reactor.util.retry.Retry;
+import reactor.util.retry.RetryBackoffSpec;
+import reactor.util.retry.RetrySpec;
+
+public class RetryStrategies {
+
+  private static final int MAX_ATTEMPTS = 20;
+  private static final Duration MIN_BACKOFF = Duration.ofMillis(200);
+  private static final Duration MAX_BACKOFF = Duration.ofSeconds(3);
+
+  private RetryStrategies() {
+    // Do not instantiate
+  }
+
+  /**
+   * Returns zero-retries strategy.
+   *
+   * @return {@link Retry} instance
+   */
+  public static Retry noRetriesRetryStrategy() {
+    return Retry.max(0);
+  }
+
+  /**
+   * Returns retry-strategy which reacts on {@link KeyNotFoundException}.
+   *
+   * @return {@link RetryBackoffSpec} instance
+   */
+  public static RetryBackoffSpec keyNotFoundRetryStrategy() {
+    return RetrySpec.backoff(MAX_ATTEMPTS, MIN_BACKOFF)
+        .maxBackoff(MAX_BACKOFF)
+        .filter(ex -> ex instanceof KeyNotFoundException);
+  }
+
+  /**
+   * Returns retry-strategy which reacts on {@link KeyNotFoundException}.
+   *
+   * @param maxAttempts maxAttempts
+   * @param minBackoff minBackoff
+   * @param maxBackoff maxBackoff
+   * @return {@link RetryBackoffSpec} instance
+   */
+  public static RetryBackoffSpec keyNotFoundRetryStrategy(
+      int maxAttempts, Duration minBackoff, Duration maxBackoff) {
+    return RetrySpec.backoff(maxAttempts, minBackoff)
+        .maxBackoff(maxBackoff)
+        .filter(ex -> ex instanceof KeyNotFoundException);
+  }
+}
diff --git a/services-security/src/main/java/io/scalecube/services/security/ServiceClaims.java b/services-security-parent/services-security/src/main/java/io/scalecube/services/security/ServiceClaims.java
similarity index 100%
rename from services-security/src/main/java/io/scalecube/services/security/ServiceClaims.java
rename to services-security-parent/services-security/src/main/java/io/scalecube/services/security/ServiceClaims.java
diff --git a/services-security/src/main/java/io/scalecube/services/security/ServiceTokenAuthenticator.java b/services-security-parent/services-security/src/main/java/io/scalecube/services/security/ServiceTokenAuthenticator.java
similarity index 65%
rename from services-security/src/main/java/io/scalecube/services/security/ServiceTokenAuthenticator.java
rename to services-security-parent/services-security/src/main/java/io/scalecube/services/security/ServiceTokenAuthenticator.java
index 8b9273312..35efe4ac8 100644
--- a/services-security/src/main/java/io/scalecube/services/security/ServiceTokenAuthenticator.java
+++ b/services-security-parent/services-security/src/main/java/io/scalecube/services/security/ServiceTokenAuthenticator.java
@@ -22,16 +22,38 @@ public final class ServiceTokenAuthenticator implements Authenticator<ServiceCla
 
   private static final Logger LOGGER = LoggerFactory.getLogger(ServiceTokenAuthenticator.class);
 
-  private final JwtTokenResolver tokenResolver;
-  private final Retry retryStrategy;
+  private JwtTokenResolver tokenResolver;
+  private Retry retryStrategy = RetryStrategies.noRetriesRetryStrategy();
 
-  public ServiceTokenAuthenticator(JwtTokenResolver tokenResolver) {
-    this(tokenResolver, Retry.max(0));
+  public ServiceTokenAuthenticator() {}
+
+  private ServiceTokenAuthenticator(ServiceTokenAuthenticator other) {
+    this.tokenResolver = other.tokenResolver;
+    this.retryStrategy = other.retryStrategy;
+  }
+
+  /**
+   * Setter for tokenResolver.
+   *
+   * @param tokenResolver tokenResolver
+   * @return new instance with applied setting
+   */
+  public ServiceTokenAuthenticator tokenResolver(JwtTokenResolver tokenResolver) {
+    final ServiceTokenAuthenticator c = copy();
+    c.tokenResolver = tokenResolver;
+    return c;
   }
 
-  public ServiceTokenAuthenticator(JwtTokenResolver tokenResolver, Retry retryStrategy) {
-    this.tokenResolver = tokenResolver;
-    this.retryStrategy = retryStrategy;
+  /**
+   * Setter for retryStrategy.
+   *
+   * @param retryStrategy retryStrategy
+   * @return new instance with applied setting
+   */
+  public ServiceTokenAuthenticator retryStrategy(Retry retryStrategy) {
+    final ServiceTokenAuthenticator c = copy();
+    c.retryStrategy = retryStrategy;
+    return c;
   }
 
   @Override
@@ -61,4 +83,8 @@ private static ServiceClaims toServiceClaims(Map<String, Object> authData) {
     }
     return new ServiceClaims(permissionsClaim);
   }
+
+  private ServiceTokenAuthenticator copy() {
+    return new ServiceTokenAuthenticator(this);
+  }
 }
diff --git a/services-security/src/main/java/io/scalecube/services/security/ServiceTokens.java b/services-security-parent/services-security/src/main/java/io/scalecube/services/security/ServiceTokens.java
similarity index 100%
rename from services-security/src/main/java/io/scalecube/services/security/ServiceTokens.java
rename to services-security-parent/services-security/src/main/java/io/scalecube/services/security/ServiceTokens.java