diff --git a/lib/puppet/provider/congress_api_paste_ini/ini_setting.rb b/lib/puppet/provider/congress_api_paste_ini/ini_setting.rb
new file mode 100644
index 0000000..9523b28
--- /dev/null
+++ b/lib/puppet/provider/congress_api_paste_ini/ini_setting.rb
@@ -0,0 +1,27 @@
+Puppet::Type.type(:congress_api_paste_ini).provide(
+  :ini_setting,
+  :parent => Puppet::Type.type(:ini_setting).provider(:ruby)
+) do
+
+  def section
+    resource[:name].split('/', 2).first
+  end
+
+  def setting
+    resource[:name].split('/', 2).last
+  end
+
+  def separator
+    '='
+  end
+
+  def self.file_path
+    '/etc/congress/api-paste.ini'
+  end
+
+  # added for backwards compatibility with older versions of inifile
+  def file_path
+    self.class.file_path
+  end
+
+end
diff --git a/lib/puppet/type/congress_api_paste_ini.rb b/lib/puppet/type/congress_api_paste_ini.rb
new file mode 100644
index 0000000..c17f4ab
--- /dev/null
+++ b/lib/puppet/type/congress_api_paste_ini.rb
@@ -0,0 +1,52 @@
+Puppet::Type.newtype(:congress_api_paste_ini) do
+
+  ensurable
+
+  newparam(:name, :namevar => true) do
+    desc 'Section/setting name to manage from /etc/congress/api-paste.ini'
+    newvalues(/\S+\/\S+/)
+  end
+
+  newproperty(:value) do
+    desc 'The value of the setting to be defined.'
+    munge do |value|
+      value = value.to_s.strip
+      value.capitalize! if value =~ /^(true|false)$/i
+      value
+    end
+
+    def is_to_s( currentvalue )
+      if resource.secret?
+        return '[old secret redacted]'
+      else
+        return currentvalue
+      end
+    end
+
+    def should_to_s( newvalue )
+      if resource.secret?
+        return '[new secret redacted]'
+      else
+        return newvalue
+      end
+    end
+  end
+
+  newparam(:secret, :boolean => true) do
+    desc 'Whether to hide the value from Puppet logs. Defaults to `false`.'
+
+    newvalues(:true, :false)
+
+    defaultto false
+  end
+
+  newparam(:ensure_absent_val) do
+    desc 'A value that is specified as the value property will behave as if ensure => absent was specified'
+    defaultto('<SERVICE DEFAULT>')
+  end
+
+  autorequire(:package) do
+    'congress-server'
+  end
+
+end
diff --git a/manifests/config.pp b/manifests/config.pp
index 255e8bb..3c459ff 100644
--- a/manifests/config.pp
+++ b/manifests/config.pp
@@ -17,16 +17,22 @@
 #     DEFAULT/bar:
 #       value: barValue
 #
+# [*congress_api_paste_ini*]
+#   (optional) Allow configuration of /etc/congress/api-paste.ini options.
+#
 #   NOTE: The configuration MUST NOT be already handled by this module
 #   or Puppet catalog compilation will fail with duplicate resources.
 #
 class congress::config (
-  $congress_config = {},
+  $congress_config    = {},
+  $congress_api_paste_ini = {},
 ) {
 
   include ::congress::deps
 
   validate_hash($congress_config)
+  validate_hash($congress_api_paste_ini)
 
   create_resources('congress_config', $congress_config)
+  create_resources('congress_api_paste_ini', $congress_api_paste_ini)
 }
diff --git a/spec/classes/congress_config_spec.rb b/spec/classes/congress_config_spec.rb
new file mode 100644
index 0000000..63883d3
--- /dev/null
+++ b/spec/classes/congress_config_spec.rb
@@ -0,0 +1,48 @@
+require 'spec_helper'
+
+describe 'congress::config' do
+
+  let(:config_hash) do {
+    'DEFAULT/foo' => { 'value'  => 'fooValue' },
+    'DEFAULT/bar' => { 'value'  => 'barValue' },
+    'DEFAULT/baz' => { 'ensure' => 'absent' }
+  }
+  end
+
+  shared_examples_for 'congress_config' do
+    let :params do
+      { :congress_config => config_hash }
+    end
+
+    it 'configures arbitrary congress-config configurations' do
+      is_expected.to contain_congress_config('DEFAULT/foo').with_value('fooValue')
+      is_expected.to contain_congress_config('DEFAULT/bar').with_value('barValue')
+      is_expected.to contain_congress_config('DEFAULT/baz').with_ensure('absent')
+    end
+  end
+
+  shared_examples_for 'congress_api_paste_ini' do
+    let :params do
+      { :congress_api_paste_ini => config_hash }
+    end
+
+    it 'configures arbitrary congress-api-paste-ini configurations' do
+      is_expected.to contain_congress_api_paste_ini('DEFAULT/foo').with_value('fooValue')
+      is_expected.to contain_congress_api_paste_ini('DEFAULT/bar').with_value('barValue')
+      is_expected.to contain_congress_api_paste_ini('DEFAULT/baz').with_ensure('absent')
+    end
+  end
+
+  on_supported_os({
+    :supported_os   => OSDefaults.get_supported_os
+  }).each do |os,facts|
+    context "on #{os}" do
+      let (:facts) do
+        facts.merge!(OSDefaults.get_facts())
+      end
+
+      it_configures 'congress_config'
+      it_configures 'congress_api_paste_ini'
+    end
+  end
+end
diff --git a/spec/unit/provider/congress_api_paste_ini/ini_setting_spec.rb b/spec/unit/provider/congress_api_paste_ini/ini_setting_spec.rb
new file mode 100644
index 0000000..a42edbb
--- /dev/null
+++ b/spec/unit/provider/congress_api_paste_ini/ini_setting_spec.rb
@@ -0,0 +1,29 @@
+#
+# these tests are a little concerning b/c they are hacking around the
+# modulepath, so these tests will not catch issues that may eventually arise
+# related to loading these plugins.
+# I could not, for the life of me, figure out how to programatcally set the modulepath
+$LOAD_PATH.push(
+  File.join(
+    File.dirname(__FILE__),
+    '..',
+    '..',
+    '..',
+    'fixtures',
+    'modules',
+    'inifile',
+    'lib')
+)
+require 'spec_helper'
+provider_class = Puppet::Type.type(:congress_api_paste_ini).provider(:ini_setting)
+describe provider_class do
+
+  it 'should allow setting to be set explicitly' do
+    resource = Puppet::Type::Congress_api_paste_ini.new(
+      {:name => 'dude/foo', :value => 'bar'}
+    )
+    provider = provider_class.new(resource)
+    expect(provider.section).to eq('dude')
+    expect(provider.setting).to eq('foo')
+  end
+end
diff --git a/spec/unit/type/congress_api_paste_ini_spec.rb b/spec/unit/type/congress_api_paste_ini_spec.rb
new file mode 100644
index 0000000..6d048ce
--- /dev/null
+++ b/spec/unit/type/congress_api_paste_ini_spec.rb
@@ -0,0 +1,34 @@
+require 'spec_helper'
+# this hack is required for now to ensure that the path is set up correctly
+# to retrieve the parent provider
+$LOAD_PATH.push(
+  File.join(
+    File.dirname(__FILE__),
+    '..',
+    '..',
+    'fixtures',
+    'modules',
+    'inifile',
+    'lib')
+)
+require 'puppet/type/congress_api_paste_ini'
+describe 'Puppet::Type.type(:congress_api_paste_ini)' do
+  before :each do
+    @congress_api_paste_ini = Puppet::Type.type(:congress_api_paste_ini).new(:name => 'DEFAULT/foo', :value => 'bar')
+  end
+  it 'should accept a valid value' do
+    @congress_api_paste_ini[:value] = 'bar'
+    expect(@congress_api_paste_ini[:value]).to eq('bar')
+  end
+
+  it 'should autorequire the package that install the file' do
+    catalog = Puppet::Resource::Catalog.new
+    package = Puppet::Type.type(:package).new(:name => 'congress-server')
+    catalog.add_resource package, @congress_api_paste_ini
+    dependency = @congress_api_paste_ini.autorequire
+    expect(dependency.size).to eq(1)
+    expect(dependency[0].target).to eq(@congress_api_paste_ini)
+    expect(dependency[0].source).to eq(package)
+  end
+
+end