diff --git a/pkg/client/auth/credentials/iam_token.go b/pkg/client/auth/credentials/iam_token.go
index b39da6d..16c51b2 100644
--- a/pkg/client/auth/credentials/iam_token.go
+++ b/pkg/client/auth/credentials/iam_token.go
@@ -1,19 +1,26 @@
 package credentials
 
-import "context"
+import (
+	"context"
+
+	"google.golang.org/grpc/metadata"
+)
 
 type iamTokenCredentialsProvider struct {
 	token string
 }
 
 // ContextWithAuth implements Provider.
-func (i *iamTokenCredentialsProvider) ContextWithAuth(context.Context) (context.Context, context.CancelFunc) {
-	panic("unimplemented")
+func (i *iamTokenCredentialsProvider) ContextWithAuth(ctx context.Context) (context.Context, context.CancelFunc) {
+	tok, _ := i.GetToken() // TODO(shmel1k@): return err as params
+	ctx, cf := context.WithCancel(ctx)
+	return metadata.AppendToOutgoingContext(ctx,
+		"x-ydb-auth-ticket", tok), cf
 }
 
 // ContextWithoutAuth implements Provider.
-func (i *iamTokenCredentialsProvider) ContextWithoutAuth(context.Context) (context.Context, context.CancelFunc) {
-	panic("unimplemented")
+func (i *iamTokenCredentialsProvider) ContextWithoutAuth(ctx context.Context) (context.Context, context.CancelFunc) {
+	return context.WithCancel(ctx)
 }
 
 // GetToken implements Provider.
diff --git a/pkg/client/auth/credentials/provider.go b/pkg/client/auth/credentials/provider.go
index 776ace4..f665800 100644
--- a/pkg/client/auth/credentials/provider.go
+++ b/pkg/client/auth/credentials/provider.go
@@ -85,7 +85,9 @@ func (b *baseProvider) Init() error {
 				"internal error: authorization type not recognized after options validation, this should never happen",
 			)
 		}
-		b.initErr = b.impl.Init()
+		if b.initErr == nil {
+			b.initErr = b.impl.Init()
+		}
 	})
 	return b.initErr
 }