from the token server 315 on the personal authentication gateway 310 in this embodiment the token server 315 is running on the personal authentication gateway device 310 and the automatic token client 320 is running on a pervasive device 325 additionally the personal authentication gateway can include a policy client 305 which determines if an automatic token client is authorized to retrieve actual user credentials and a token store 300 which stores user credential tokens an automatic token client 320 sends a token request 330 including a unique identification slave_id of the client to the token server 315 to retrieve actual user tokens for client applications running on the pervasive device 325 the token server 315 first checks the policy step 345 to determine based on the slave_id if this automatic token client is authorized to receive user credentials then the set of user credentials for this automatic token client are determined retrieved step 340 from the token store 300 and then sent with a token response message 335 to the automatic token client in a preferred embodiment the credentials are designed to expire after a short period of time on the order of about 10 minutes the automatic token client 320 stores retrieved tokens 355 in a local token store 350 on the pervasive device 325 client applications on the pervasive device 325 are.