diff --git a/src/_zkapauthorizer/_storage_client.py b/src/_zkapauthorizer/_storage_client.py
index 7c7c2a8158090e77dfaac9d9b73169a14844431b..7bf9d80cabca4e8ef3321af3e6686fd3945aeeb4 100644
--- a/src/_zkapauthorizer/_storage_client.py
+++ b/src/_zkapauthorizer/_storage_client.py
@@ -53,17 +53,17 @@ class ZKAPAuthorizerStorageClient(object):
         which can be used to authorize an operation.
     """
     _get_rref = attr.ib()
-    _get_tokens = attr.ib()
+    _get_passes = attr.ib()
 
     @property
     def _rref(self):
         return self._get_rref()
 
-    def _get_encoded_tokens(self):
+    def _get_encoded_passes(self):
         return list(
             t.text.encode("ascii")
             for t
-            in self._get_tokens()
+            in self._get_passes()
         )
 
     def get_version(self):
@@ -82,7 +82,7 @@ class ZKAPAuthorizerStorageClient(object):
     ):
         return self._rref.callRemote(
             "allocate_buckets",
-            self._get_encoded_tokens(),
+            self._get_encoded_passes(),
             storage_index,
             renew_secret,
             cancel_secret,
@@ -108,7 +108,7 @@ class ZKAPAuthorizerStorageClient(object):
     ):
         return self._rref.callRemote(
             "add_lease",
-            self._get_encoded_tokens(),
+            self._get_encoded_passes(),
             storage_index,
             renew_secret,
             cancel_secret,
@@ -121,7 +121,7 @@ class ZKAPAuthorizerStorageClient(object):
     ):
         return self._rref.callRemote(
             "renew_lease",
-            self._get_encoded_tokens(),
+            self._get_encoded_passes(),
             storage_index,
             renew_secret,
         )
@@ -150,7 +150,7 @@ class ZKAPAuthorizerStorageClient(object):
     ):
         return self._rref.callRemote(
             "slot_testv_and_readv_and_writev",
-            self._get_encoded_tokens(),
+            self._get_encoded_passes(),
             storage_index,
             secrets,
             tw_vectors,
diff --git a/src/_zkapauthorizer/tests/test_storage_protocol.py b/src/_zkapauthorizer/tests/test_storage_protocol.py
index 421d6e7e342f68a7dc2ac39e85805367fb017056..0eb82e0a56227452e4ff9e42875ed2dcdda41577 100644
--- a/src/_zkapauthorizer/tests/test_storage_protocol.py
+++ b/src/_zkapauthorizer/tests/test_storage_protocol.py
@@ -159,7 +159,7 @@ class ShareTests(TestCase):
         self.canary = LocalReferenceable(None)
         self.anonymous_storage_server = self.useFixture(AnonymousStorageServer()).storage_server
 
-        def get_tokens():
+        def get_passes():
             return [Pass(u"x" * TOKEN_LENGTH)]
 
         self.server = ZKAPAuthorizerStorageServer(
@@ -168,7 +168,7 @@ class ShareTests(TestCase):
         self.local_remote_server = LocalRemote(self.server)
         self.client = ZKAPAuthorizerStorageClient(
             get_rref=lambda: self.local_remote_server,
-            get_tokens=get_tokens,
+            get_passes=get_passes,
         )
 
     def test_get_version(self):
@@ -512,7 +512,7 @@ class ShareTests(TestCase):
         d = self.client._rref.callRemote(
             "slot_testv_and_readv_and_writev",
             # tokens
-            self.client._get_tokens(),
+            self.client._get_encoded_passes(),
             # storage_index
             storage_index,
             # secrets