diff --git a/clientv3/auth.go b/clientv3/auth.go
index 7545bb6ca..6ffe48b0c 100644
--- a/clientv3/auth.go
+++ b/clientv3/auth.go
@@ -19,8 +19,8 @@ import (
 	"fmt"
 	"strings"
 
-	"github.com/coreos/etcd/auth/authpb"
 	pb "github.com/coreos/etcd/etcdserver/etcdserverpb"
+	"github.com/coreos/etcd/internal/auth/authpb"
 
 	"google.golang.org/grpc"
 )
diff --git a/clientv3/main_test.go b/clientv3/main_test.go
index 89b30860b..cf5e6d697 100644
--- a/clientv3/main_test.go
+++ b/clientv3/main_test.go
@@ -22,8 +22,8 @@ import (
 	"testing"
 	"time"
 
-	"github.com/coreos/etcd/auth"
 	"github.com/coreos/etcd/integration"
+	"github.com/coreos/etcd/internal/auth"
 	"github.com/coreos/etcd/pkg/testutil"
 	"golang.org/x/crypto/bcrypt"
 )
diff --git a/embed/serve_test.go b/embed/serve_test.go
index d46631fcf..55274d988 100644
--- a/embed/serve_test.go
+++ b/embed/serve_test.go
@@ -19,7 +19,7 @@ import (
 	"os"
 	"testing"
 
-	"github.com/coreos/etcd/auth"
+	"github.com/coreos/etcd/internal/auth"
 )
 
 // TestStartEtcdWrongToken ensures that StartEtcd with wrong configs returns with error.
diff --git a/etcdserver/api/v3rpc/maintenance.go b/etcdserver/api/v3rpc/maintenance.go
index 18ed30a59..9b402aa0d 100644
--- a/etcdserver/api/v3rpc/maintenance.go
+++ b/etcdserver/api/v3rpc/maintenance.go
@@ -19,10 +19,10 @@ import (
 	"crypto/sha256"
 	"io"
 
-	"github.com/coreos/etcd/auth"
 	"github.com/coreos/etcd/etcdserver"
 	"github.com/coreos/etcd/etcdserver/api/v3rpc/rpctypes"
 	pb "github.com/coreos/etcd/etcdserver/etcdserverpb"
+	"github.com/coreos/etcd/internal/auth"
 	"github.com/coreos/etcd/internal/mvcc"
 	"github.com/coreos/etcd/internal/mvcc/backend"
 	"github.com/coreos/etcd/pkg/types"
diff --git a/etcdserver/api/v3rpc/util.go b/etcdserver/api/v3rpc/util.go
index bd092b3a1..5ad962a6a 100644
--- a/etcdserver/api/v3rpc/util.go
+++ b/etcdserver/api/v3rpc/util.go
@@ -18,10 +18,10 @@ import (
 	"context"
 	"strings"
 
-	"github.com/coreos/etcd/auth"
 	"github.com/coreos/etcd/etcdserver"
 	"github.com/coreos/etcd/etcdserver/api/v3rpc/rpctypes"
 	"github.com/coreos/etcd/etcdserver/membership"
+	"github.com/coreos/etcd/internal/auth"
 	"github.com/coreos/etcd/internal/lease"
 	"github.com/coreos/etcd/internal/mvcc"
 
diff --git a/etcdserver/api/v3rpc/watch.go b/etcdserver/api/v3rpc/watch.go
index d8e05ee50..65ad02d13 100644
--- a/etcdserver/api/v3rpc/watch.go
+++ b/etcdserver/api/v3rpc/watch.go
@@ -20,10 +20,10 @@ import (
 	"sync"
 	"time"
 
-	"github.com/coreos/etcd/auth"
 	"github.com/coreos/etcd/etcdserver"
 	"github.com/coreos/etcd/etcdserver/api/v3rpc/rpctypes"
 	pb "github.com/coreos/etcd/etcdserver/etcdserverpb"
+	"github.com/coreos/etcd/internal/auth"
 	"github.com/coreos/etcd/internal/mvcc"
 	"github.com/coreos/etcd/internal/mvcc/mvccpb"
 )
diff --git a/etcdserver/apply.go b/etcdserver/apply.go
index a79099294..93f5ed04c 100644
--- a/etcdserver/apply.go
+++ b/etcdserver/apply.go
@@ -20,8 +20,8 @@ import (
 	"sort"
 	"time"
 
-	"github.com/coreos/etcd/auth"
 	pb "github.com/coreos/etcd/etcdserver/etcdserverpb"
+	"github.com/coreos/etcd/internal/auth"
 	"github.com/coreos/etcd/internal/lease"
 	"github.com/coreos/etcd/internal/mvcc"
 	"github.com/coreos/etcd/internal/mvcc/mvccpb"
diff --git a/etcdserver/apply_auth.go b/etcdserver/apply_auth.go
index d95385af3..9f3516ee1 100644
--- a/etcdserver/apply_auth.go
+++ b/etcdserver/apply_auth.go
@@ -17,8 +17,8 @@ package etcdserver
 import (
 	"sync"
 
-	"github.com/coreos/etcd/auth"
 	pb "github.com/coreos/etcd/etcdserver/etcdserverpb"
+	"github.com/coreos/etcd/internal/auth"
 	"github.com/coreos/etcd/internal/lease"
 	"github.com/coreos/etcd/internal/mvcc"
 )
diff --git a/etcdserver/etcdserverpb/rpc.pb.go b/etcdserver/etcdserverpb/rpc.pb.go
index ce9e87c2a..a6c4761dc 100644
--- a/etcdserver/etcdserverpb/rpc.pb.go
+++ b/etcdserver/etcdserverpb/rpc.pb.go
@@ -14,7 +14,7 @@ import (
 
 	mvccpb "github.com/coreos/etcd/internal/mvcc/mvccpb"
 
-	authpb "github.com/coreos/etcd/auth/authpb"
+	authpb "github.com/coreos/etcd/internal/auth/authpb"
 
 	context "golang.org/x/net/context"
 
diff --git a/etcdserver/server.go b/etcdserver/server.go
index 87aeed658..d55b3ee77 100644
--- a/etcdserver/server.go
+++ b/etcdserver/server.go
@@ -29,13 +29,13 @@ import (
 	"sync/atomic"
 	"time"
 
-	"github.com/coreos/etcd/auth"
 	"github.com/coreos/etcd/etcdserver/api"
 	"github.com/coreos/etcd/etcdserver/api/v2http/httptypes"
 	pb "github.com/coreos/etcd/etcdserver/etcdserverpb"
 	"github.com/coreos/etcd/etcdserver/membership"
 	"github.com/coreos/etcd/etcdserver/stats"
 	"github.com/coreos/etcd/internal/alarm"
+	"github.com/coreos/etcd/internal/auth"
 	"github.com/coreos/etcd/internal/compactor"
 	"github.com/coreos/etcd/internal/discovery"
 	"github.com/coreos/etcd/internal/lease"
diff --git a/etcdserver/v3_server.go b/etcdserver/v3_server.go
index a66897099..d506b1ab0 100644
--- a/etcdserver/v3_server.go
+++ b/etcdserver/v3_server.go
@@ -20,9 +20,9 @@ import (
 	"encoding/binary"
 	"time"
 
-	"github.com/coreos/etcd/auth"
 	pb "github.com/coreos/etcd/etcdserver/etcdserverpb"
 	"github.com/coreos/etcd/etcdserver/membership"
+	"github.com/coreos/etcd/internal/auth"
 	"github.com/coreos/etcd/internal/lease"
 	"github.com/coreos/etcd/internal/lease/leasehttp"
 	"github.com/coreos/etcd/internal/mvcc"
diff --git a/integration/v3_auth_test.go b/integration/v3_auth_test.go
index 97017a07f..2c80c743b 100644
--- a/integration/v3_auth_test.go
+++ b/integration/v3_auth_test.go
@@ -21,10 +21,10 @@ import (
 	"testing"
 	"time"
 
-	"github.com/coreos/etcd/auth/authpb"
 	"github.com/coreos/etcd/clientv3"
 	"github.com/coreos/etcd/etcdserver/api/v3rpc/rpctypes"
 	pb "github.com/coreos/etcd/etcdserver/etcdserverpb"
+	"github.com/coreos/etcd/internal/auth/authpb"
 	"github.com/coreos/etcd/pkg/testutil"
 )
 
diff --git a/auth/authpb/auth.pb.go b/internal/auth/authpb/auth.pb.go
similarity index 100%
rename from auth/authpb/auth.pb.go
rename to internal/auth/authpb/auth.pb.go
diff --git a/auth/authpb/auth.proto b/internal/auth/authpb/auth.proto
similarity index 100%
rename from auth/authpb/auth.proto
rename to internal/auth/authpb/auth.proto
diff --git a/auth/doc.go b/internal/auth/doc.go
similarity index 100%
rename from auth/doc.go
rename to internal/auth/doc.go
diff --git a/auth/jwt.go b/internal/auth/jwt.go
similarity index 100%
rename from auth/jwt.go
rename to internal/auth/jwt.go
diff --git a/auth/jwt_test.go b/internal/auth/jwt_test.go
similarity index 95%
rename from auth/jwt_test.go
rename to internal/auth/jwt_test.go
index 35e11dee2..36b50f9ad 100644
--- a/auth/jwt_test.go
+++ b/internal/auth/jwt_test.go
@@ -20,8 +20,8 @@ import (
 )
 
 const (
-	jwtPubKey  = "../integration/fixtures/server.crt"
-	jwtPrivKey = "../integration/fixtures/server.key.insecure"
+	jwtPubKey  = "../../integration/fixtures/server.crt"
+	jwtPrivKey = "../../integration/fixtures/server.key.insecure"
 )
 
 func TestJWTInfo(t *testing.T) {
diff --git a/auth/range_perm_cache.go b/internal/auth/range_perm_cache.go
similarity index 98%
rename from auth/range_perm_cache.go
rename to internal/auth/range_perm_cache.go
index 62acdf26d..241239358 100644
--- a/auth/range_perm_cache.go
+++ b/internal/auth/range_perm_cache.go
@@ -15,7 +15,7 @@
 package auth
 
 import (
-	"github.com/coreos/etcd/auth/authpb"
+	"github.com/coreos/etcd/internal/auth/authpb"
 	"github.com/coreos/etcd/internal/mvcc/backend"
 	"github.com/coreos/etcd/pkg/adt"
 )
diff --git a/auth/range_perm_cache_test.go b/internal/auth/range_perm_cache_test.go
similarity index 97%
rename from auth/range_perm_cache_test.go
rename to internal/auth/range_perm_cache_test.go
index fd8df6a9e..c0a0ae6bc 100644
--- a/auth/range_perm_cache_test.go
+++ b/internal/auth/range_perm_cache_test.go
@@ -17,7 +17,7 @@ package auth
 import (
 	"testing"
 
-	"github.com/coreos/etcd/auth/authpb"
+	"github.com/coreos/etcd/internal/auth/authpb"
 	"github.com/coreos/etcd/pkg/adt"
 )
 
diff --git a/auth/simple_token.go b/internal/auth/simple_token.go
similarity index 100%
rename from auth/simple_token.go
rename to internal/auth/simple_token.go
diff --git a/auth/simple_token_test.go b/internal/auth/simple_token_test.go
similarity index 100%
rename from auth/simple_token_test.go
rename to internal/auth/simple_token_test.go
diff --git a/auth/store.go b/internal/auth/store.go
similarity index 99%
rename from auth/store.go
rename to internal/auth/store.go
index e93560896..7796c5d8a 100644
--- a/auth/store.go
+++ b/internal/auth/store.go
@@ -24,8 +24,8 @@ import (
 	"sync"
 	"sync/atomic"
 
-	"github.com/coreos/etcd/auth/authpb"
 	pb "github.com/coreos/etcd/etcdserver/etcdserverpb"
+	"github.com/coreos/etcd/internal/auth/authpb"
 	"github.com/coreos/etcd/internal/mvcc/backend"
 
 	"github.com/coreos/pkg/capnslog"
diff --git a/auth/store_test.go b/internal/auth/store_test.go
similarity index 99%
rename from auth/store_test.go
rename to internal/auth/store_test.go
index 739d8fcde..2aa7d51a8 100644
--- a/auth/store_test.go
+++ b/internal/auth/store_test.go
@@ -24,8 +24,8 @@ import (
 	"testing"
 	"time"
 
-	"github.com/coreos/etcd/auth/authpb"
 	pb "github.com/coreos/etcd/etcdserver/etcdserverpb"
+	"github.com/coreos/etcd/internal/auth/authpb"
 	"github.com/coreos/etcd/internal/mvcc/backend"
 
 	"golang.org/x/crypto/bcrypt"