diff --git a/swift/common/middleware/s3api/s3token.py b/swift/common/middleware/s3api/s3token.py
index ab00cd747c..4390c2a72c 100644
--- a/swift/common/middleware/s3api/s3token.py
+++ b/swift/common/middleware/s3api/s3token.py
@@ -162,7 +162,9 @@ class S3Token(object):
             self._verify = None
 
         self._secret_cache_duration = int(conf.get('secret_cache_duration', 0))
-        if self._secret_cache_duration > 0:
+        if self._secret_cache_duration < 0:
+            raise ValueError('secret_cache_duration must be non-negative')
+        if self._secret_cache_duration:
             try:
                 auth_plugin = keystone_loading.get_plugin_loader(
                     conf.get('auth_type', 'password'))