diff --git a/deployers/whiskclient.go b/deployers/whiskclient.go
index 4d980b462..741ec8110 100644
--- a/deployers/whiskclient.go
+++ b/deployers/whiskclient.go
@@ -55,6 +55,9 @@ type PropertyValue struct {
 	Source string
 }
 
+// Note buyer beware this function returns the existing value, and only if there is not
+// an existing value does it set it to newValue. We should perhaps rename this function
+// as it implies that it is a getter, when this is not strictly true
 var GetPropertyValue = func(prop PropertyValue, newValue string, source string) PropertyValue {
 	if len(prop.Value) == 0 && len(newValue) > 0 {
 		prop.Value = newValue
@@ -201,12 +204,6 @@ func NewWhiskConfig(proppath string, deploymentPath string, manifestPath string)
 	// reset credential, apiHost, namespace, etc to avoid any conflicts as they initialized globally
 	resetWhiskConfig()
 
-	// initialize APIGW_ACCESS_TOKEN to "DUMMY TOKEN" for Travis builds
-	if strings.ToLower(os.Getenv("TRAVIS")) == "true" {
-		apigwAccessToken.Value = "DUMMY TOKEN"
-		apigwAccessToken.Source = SOURCE_DEFAULT_VALUE
-	}
-
 	// read from command line
 	readFromCLI()
 
@@ -230,6 +227,14 @@ func NewWhiskConfig(proppath string, deploymentPath string, manifestPath string)
 	// TODO() whisk.properties should be deprecated
 	readFromWhiskProperty(pi)
 
+	// As a last resort initialize APIGW_ACCESS_TOKEN to "DUMMY TOKEN" for Travis builds
+	// The reason DUMMY TOKEN is not always true for Travis builds is that they may want
+	// to use Travis as a CD vehicle in which case we need to respect the other values
+	// that may be set before.
+	if strings.ToLower(os.Getenv("TRAVIS")) == "true" {
+		apigwAccessToken = GetPropertyValue(apigwAccessToken, "DUMMY TOKEN", SOURCE_DEFAULT_VALUE)
+	}
+
 	// set namespace to default namespace if not yet found
 	if len(apiHost.Value) != 0 && len(credential.Value) != 0 && len(namespace.Value) == 0 {
 		namespace.Value = whisk.DEFAULT_NAMESPACE
diff --git a/docs/wskdeploy_faq.md b/docs/wskdeploy_faq.md
index a6d478cc0..ef7017d13 100644
--- a/docs/wskdeploy_faq.md
+++ b/docs/wskdeploy_faq.md
@@ -27,3 +27,12 @@
 
 -  The ```wskdeploy``` utility will cease deploying as soon as it receives an error from the target platform and display what error information it receives to you.
 - then it will attempt to undeploy any entities that it attempted to deploy.
+
+### What is the order of precedence for OpenWhisk credentials?
+
+- The ```wskdeploy``` utility finds the credentials (apihost, namespace, and auth) as well as the APIGW_ACCESS_TOKEN in the folowing precedence from highest to lowest:
+  - ```wskdeploy``` command line (i.e. ```wskdeploy --apihost --namespace --auth```)
+  - The deployment file
+  - The manifest file
+  - The .wskprops file
+- So when filling out the credentials and the APIGW_ACCESS_TOKEN, it first looks to the command line. Anything not found on the command line is attempted to be filled by the deployment file. Next it searches for all the unfilled values in the manifest file, and finally any unfilled values are looked for in the .wskprops file. After failing to find a value in the places mentioned above, namespace will default to "_". In the case of a TravisCI environment, APIGW_ACCESS_TOKEN will be set to "DUMMY TOKEN" if it is not already set via one of the mechanisms described previously.