diff --git a/README.rst b/README.rst
index 4ea7000d4b..b8e26c9fae 100644
--- a/README.rst
+++ b/README.rst
@@ -67,6 +67,7 @@ The 'password flow' variation is most commonly used::
    export OS_TENANT_NAME=<tenant-name>
    export OS_USERNAME=<user-name>
    export OS_PASSWORD=<password> # (optional)
+   export OS_USE_KEYRING=true # (optional)
 
 The corresponding command-line options look very similar::
 
@@ -74,9 +75,12 @@ The corresponding command-line options look very similar::
    --os-tenant-name <tenant-name>
    --os-username <user-name>
    [--os-password <password>]
+   [--os-use-keyring]
 
 If a password is not provided above (in plaintext), you will be interactively
-prompted to provide one securely.
+prompted to provide one securely. If keyring is enabled, the password entered
+in the prompt is stored in keyring. From next time, the password is read from
+keyring, if it is not provided above (in plaintext).
 
 The token flow variation for authentication uses an already-aquired token
 and a URL pointing directly to the service API that presumably was acquired