diff --git a/riptide-spring-boot-autoconfigure/src/main/java/org/zalando/riptide/autoconfigure/AccessTokensFactory.java b/riptide-spring-boot-autoconfigure/src/main/java/org/zalando/riptide/autoconfigure/AccessTokensFactory.java
new file mode 100644
index 000000000..328bdccc7
--- /dev/null
+++ b/riptide-spring-boot-autoconfigure/src/main/java/org/zalando/riptide/autoconfigure/AccessTokensFactory.java
@@ -0,0 +1,76 @@
+package org.zalando.riptide.autoconfigure;
+
+import org.zalando.stups.tokens.AccessTokens;
+import org.zalando.stups.tokens.AccessTokensBuilder;
+import org.zalando.stups.tokens.JsonFileBackedClientCredentialsProvider;
+import org.zalando.stups.tokens.JsonFileBackedUserCredentialsProvider;
+import org.zalando.stups.tokens.Tokens;
+
+import javax.annotation.Nullable;
+import java.net.URI;
+import java.nio.file.Path;
+import java.util.concurrent.TimeUnit;
+
+import static com.google.common.base.Preconditions.checkArgument;
+
+@SuppressWarnings("unused")
+final class AccessTokensFactory {
+
+    private AccessTokensFactory() {
+
+    }
+
+    public static AccessTokens createAccessTokens(final RiptideProperties properties) {
+        final RiptideProperties.GlobalOAuth oAuth = properties.getOauth();
+
+        final URI accessTokenUrl = getAccessTokenUrl(oAuth);
+        @Nullable final Path directory = oAuth.getCredentialsDirectory();
+        final TimeSpan connectTimeout = oAuth.getConnectTimeout();
+        final TimeSpan socketTimeout = oAuth.getSocketTimeout();
+
+        final AccessTokensBuilder builder = Tokens.createAccessTokensWithUri(accessTokenUrl)
+                .usingClientCredentialsProvider(getClientCredentialsProvider(directory))
+                .usingUserCredentialsProvider(getUserCredentialsProvider(directory))
+                .schedulingPeriod((int) oAuth.getSchedulingPeriod().getAmount())
+                .schedulingTimeUnit(oAuth.getSchedulingPeriod().getUnit())
+                .connectTimeout((int) connectTimeout.to(TimeUnit.MILLISECONDS))
+                .socketTimeout((int) socketTimeout.to(TimeUnit.MILLISECONDS));
+
+        properties.getClients().forEach((id, client) -> {
+            @Nullable final RiptideProperties.Client.OAuth clientOAuth = client.getOauth();
+
+            if (clientOAuth == null) {
+                return;
+            }
+
+            builder.manageToken(id)
+                    .addScopesTypeSafe(clientOAuth.getScopes())
+                    .done();
+        });
+
+        return builder.start();
+    }
+
+    private static JsonFileBackedClientCredentialsProvider getClientCredentialsProvider(@Nullable final Path directory) {
+        return directory == null ?
+                new JsonFileBackedClientCredentialsProvider() :
+                new JsonFileBackedClientCredentialsProvider(directory.resolve("client.json").toFile());
+    }
+
+    private static JsonFileBackedUserCredentialsProvider getUserCredentialsProvider(@Nullable final Path directory) {
+        return directory == null ?
+                new JsonFileBackedUserCredentialsProvider() :
+                new JsonFileBackedUserCredentialsProvider(directory.resolve("user.json").toFile());
+    }
+
+    private static URI getAccessTokenUrl(final RiptideProperties.GlobalOAuth oauth) {
+        @Nullable final URI accessTokenUrl = oauth.getAccessTokenUrl();
+
+        checkArgument(accessTokenUrl != null, "" +
+                "Neither 'riptide.oauth.access-token-url' nor 'ACCESS_TOKEN_URL' was set, " +
+                "but at least one client requires OAuth");
+
+        return accessTokenUrl;
+    }
+
+}
diff --git a/riptide-spring-boot-autoconfigure/src/main/java/org/zalando/riptide/autoconfigure/DefaultRiptideRegistrar.java b/riptide-spring-boot-autoconfigure/src/main/java/org/zalando/riptide/autoconfigure/DefaultRiptideRegistrar.java
index c35bb55fd..b612500f5 100644
--- a/riptide-spring-boot-autoconfigure/src/main/java/org/zalando/riptide/autoconfigure/DefaultRiptideRegistrar.java
+++ b/riptide-spring-boot-autoconfigure/src/main/java/org/zalando/riptide/autoconfigure/DefaultRiptideRegistrar.java
@@ -27,6 +27,7 @@
 import org.zalando.riptide.OriginalStackTracePlugin;
 import org.zalando.riptide.Plugin;
 import org.zalando.riptide.PluginInterceptor;
+import org.zalando.riptide.autoconfigure.RiptideProperties.Client;
 import org.zalando.riptide.backup.BackupRequestPlugin;
 import org.zalando.riptide.failsafe.CircuitBreakerListener;
 import org.zalando.riptide.failsafe.FailsafePlugin;
@@ -37,7 +38,6 @@
 import org.zalando.riptide.httpclient.RestAsyncClientHttpRequestFactory;
 import org.zalando.riptide.httpclient.metrics.HttpConnectionPoolMetrics;
 import org.zalando.riptide.metrics.MetricsPlugin;
-import org.zalando.riptide.spring.RiptideProperties.Client;
 import org.zalando.riptide.stream.Streams;
 import org.zalando.riptide.timeout.TimeoutPlugin;
 import org.zalando.stups.oauth2.httpcomponents.AccessTokensRequestInterceptor;
diff --git a/riptide-spring-boot-starter/src/main/java/org/zalando/riptide/spring/FailsafePluginFactory.java b/riptide-spring-boot-autoconfigure/src/main/java/org/zalando/riptide/autoconfigure/FailsafePluginFactory.java
similarity index 98%
rename from riptide-spring-boot-starter/src/main/java/org/zalando/riptide/spring/FailsafePluginFactory.java
rename to riptide-spring-boot-autoconfigure/src/main/java/org/zalando/riptide/autoconfigure/FailsafePluginFactory.java
index f39a4e874..017f9e170 100644
--- a/riptide-spring-boot-starter/src/main/java/org/zalando/riptide/spring/FailsafePluginFactory.java
+++ b/riptide-spring-boot-autoconfigure/src/main/java/org/zalando/riptide/autoconfigure/FailsafePluginFactory.java
@@ -1,4 +1,4 @@
-package org.zalando.riptide.spring;
+package org.zalando.riptide.autoconfigure;
 
 import net.jodah.failsafe.CircuitBreaker;
 import net.jodah.failsafe.RetryPolicy;
diff --git a/riptide-spring-boot-starter/src/main/java/org/zalando/riptide/spring/HttpClientFactory.java b/riptide-spring-boot-autoconfigure/src/main/java/org/zalando/riptide/autoconfigure/HttpClientFactory.java
similarity index 97%
rename from riptide-spring-boot-starter/src/main/java/org/zalando/riptide/spring/HttpClientFactory.java
rename to riptide-spring-boot-autoconfigure/src/main/java/org/zalando/riptide/autoconfigure/HttpClientFactory.java
index 647ec87ab..6a3c58233 100644
--- a/riptide-spring-boot-starter/src/main/java/org/zalando/riptide/spring/HttpClientFactory.java
+++ b/riptide-spring-boot-autoconfigure/src/main/java/org/zalando/riptide/autoconfigure/HttpClientFactory.java
@@ -1,4 +1,4 @@
-package org.zalando.riptide.spring;
+package org.zalando.riptide.autoconfigure;
 
 import lombok.extern.slf4j.Slf4j;
 import org.apache.http.HttpRequestInterceptor;
@@ -13,7 +13,7 @@
 import org.apache.http.impl.client.HttpClientBuilder;
 import org.apache.http.impl.conn.PoolingHttpClientConnectionManager;
 import org.apache.http.ssl.SSLContexts;
-import org.zalando.riptide.spring.RiptideProperties.Client;
+import org.zalando.riptide.autoconfigure.RiptideProperties.Client;
 
 import javax.annotation.Nullable;
 import javax.net.ssl.SSLContext;
diff --git a/riptide-spring-boot-starter/src/main/java/org/zalando/riptide/spring/MetricsPluginFactory.java b/riptide-spring-boot-autoconfigure/src/main/java/org/zalando/riptide/autoconfigure/MetricsPluginFactory.java
similarity index 97%
rename from riptide-spring-boot-starter/src/main/java/org/zalando/riptide/spring/MetricsPluginFactory.java
rename to riptide-spring-boot-autoconfigure/src/main/java/org/zalando/riptide/autoconfigure/MetricsPluginFactory.java
index ea98f180e..3e6f0c495 100644
--- a/riptide-spring-boot-starter/src/main/java/org/zalando/riptide/spring/MetricsPluginFactory.java
+++ b/riptide-spring-boot-autoconfigure/src/main/java/org/zalando/riptide/autoconfigure/MetricsPluginFactory.java
@@ -1,4 +1,4 @@
-package org.zalando.riptide.spring;
+package org.zalando.riptide.autoconfigure;
 
 import com.google.common.collect.ImmutableList;
 import io.micrometer.core.instrument.MeterRegistry;
diff --git a/riptide-spring-boot-autoconfigure/src/main/java/org/zalando/riptide/autoconfigure/RiptideProperties.java b/riptide-spring-boot-autoconfigure/src/main/java/org/zalando/riptide/autoconfigure/RiptideProperties.java
index 001a320dd..6e7ad9c2a 100644
--- a/riptide-spring-boot-autoconfigure/src/main/java/org/zalando/riptide/autoconfigure/RiptideProperties.java
+++ b/riptide-spring-boot-autoconfigure/src/main/java/org/zalando/riptide/autoconfigure/RiptideProperties.java
@@ -99,7 +99,6 @@ public static final class Client {
         @Getter
         @Setter
         @NoArgsConstructor
-        @AllArgsConstructor
         public static final class OAuth {
             private List<String> scopes = new ArrayList<>();
 
diff --git a/riptide-spring-boot-starter/src/test/java/org/zalando/riptide/spring/HttpClientFactoryTest.java b/riptide-spring-boot-autoconfigure/src/test/java/org/zalando/riptide/autoconfigure/HttpClientFactoryTest.java
similarity index 86%
rename from riptide-spring-boot-starter/src/test/java/org/zalando/riptide/spring/HttpClientFactoryTest.java
rename to riptide-spring-boot-autoconfigure/src/test/java/org/zalando/riptide/autoconfigure/HttpClientFactoryTest.java
index 9b44d01ab..b373bc08f 100644
--- a/riptide-spring-boot-starter/src/test/java/org/zalando/riptide/spring/HttpClientFactoryTest.java
+++ b/riptide-spring-boot-autoconfigure/src/test/java/org/zalando/riptide/autoconfigure/HttpClientFactoryTest.java
@@ -1,12 +1,12 @@
-package org.zalando.riptide.spring;
+package org.zalando.riptide.autoconfigure;
 
 import com.google.common.collect.ImmutableMap;
 import org.junit.Rule;
 import org.junit.Test;
 import org.junit.rules.ExpectedException;
-import org.zalando.riptide.spring.RiptideProperties.Client.Keystore;
-import org.zalando.riptide.spring.RiptideProperties.Defaults;
-import org.zalando.riptide.spring.RiptideProperties.GlobalOAuth;
+import org.zalando.riptide.autoconfigure.RiptideProperties.Client.Keystore;
+import org.zalando.riptide.autoconfigure.RiptideProperties.Defaults;
+import org.zalando.riptide.autoconfigure.RiptideProperties.GlobalOAuth;
 
 import java.io.FileNotFoundException;
 import java.io.IOException;
diff --git a/riptide-spring-boot-autoconfigure/src/test/resources/application-credentials-directory.yml b/riptide-spring-boot-autoconfigure/src/test/resources/application-credentials-directory.yml
index c45c006ec..2a561d00d 100644
--- a/riptide-spring-boot-autoconfigure/src/test/resources/application-credentials-directory.yml
+++ b/riptide-spring-boot-autoconfigure/src/test/resources/application-credentials-directory.yml
@@ -8,6 +8,7 @@ riptide:
   oauth:
     access-token-url: http://example.com
     credentials-directory: src/test/resources
+
   clients:
     example:
       oauth.scopes: