diff --git a/octodns/provider/transip.py b/octodns/provider/transip.py
index 2bdedc4..67011f9 100644
--- a/octodns/provider/transip.py
+++ b/octodns/provider/transip.py
@@ -57,26 +57,38 @@ class TransipProvider(BaseProvider):
     TIMEOUT = 15
     ROOT_RECORD = '@'
 
-    def __init__(self, id, account, key=None, key_file=None,  *args, **kwargs):
+    def __init__(self, id, account, key=None, key_file=None, *args, **kwargs):
         self.log = getLogger('TransipProvider[{}]'.format(id))
         self.log.debug('__init__: id=%s, account=%s, token=***', id,
                        account)
         super(TransipProvider, self).__init__(id, *args, **kwargs)
 
-        if key_file is not None:
-            self._client = DomainService(account, private_key_file=key_file)
-        elif key is not None:
-            self._client = DomainService(account, private_key=key)
-        else:
+        if key is None and key_file is None:
             raise TransipConfigException(
-                'Missing `key` of `key_file` parameter in config'
+                'Missing `key` or `key_file` parameter in config'
             )
 
         self.account = account
         self.key = key
+        self.key_file = key_file
 
+        self._client = None
         self._currentZone = {}
 
+    @property
+    def client(self):
+        # This can't happen in __init__ b/c it makes network calls during the
+        # construction of the object and that before the tests have had a
+        # chance to install the mock client
+        if self._client is None:
+            if self.key_file is not None:
+                self._client = DomainService(self.account,
+                                             private_key_file=self.key_file)
+            else:  # we checked key in __init__ so can assume it's not None
+                self._client = DomainService(self.account,
+                                             private_key=self.key)
+        return self._client
+
     def populate(self, zone, target=False, lenient=False):
 
         exists = False
@@ -86,7 +98,7 @@ class TransipProvider(BaseProvider):
 
         before = len(zone.records)
         try:
-            zoneInfo = self._client.get_info(zone.name[:-1])
+            zoneInfo = self.client.get_info(zone.name[:-1])
         except WebFault as e:
             if e.fault.faultcode == '102' and target is False:
                 # Zone not found in account, and not a target so just
@@ -136,7 +148,7 @@ class TransipProvider(BaseProvider):
 
         self._currentZone = plan.desired
         try:
-            self._client.get_info(plan.desired.name[:-1])
+            self.client.get_info(plan.desired.name[:-1])
         except WebFault as e:
             self.log.exception('_apply: get_info failed')
             raise e
@@ -155,7 +167,7 @@ class TransipProvider(BaseProvider):
                 _dns_entries.extend(entries_for(name, record))
 
         try:
-            self._client.set_dns_entries(plan.desired.name[:-1], _dns_entries)
+            self.client.set_dns_entries(plan.desired.name[:-1], _dns_entries)
         except WebFault as e:
             self.log.warning(('_apply: Set DNS returned ' +
                               'one or more errors: {}').format(
diff --git a/tests/test_octodns_provider_transip.py b/tests/test_octodns_provider_transip.py
index 234c95e..4817f7d 100644
--- a/tests/test_octodns_provider_transip.py
+++ b/tests/test_octodns_provider_transip.py
@@ -15,7 +15,6 @@ from unittest import TestCase
 from octodns.provider.transip import TransipProvider
 from octodns.provider.yaml import YamlProvider
 from octodns.zone import Zone
-from transip.service.domain import DomainService
 from transip.service.objects import DnsEntry
 
 
@@ -32,12 +31,11 @@ class MockResponse(object):
     dnsEntries = []
 
 
-class MockDomainService(DomainService):
+class MockDomainService(object):
 
     def __init__(self, *args, **kwargs):
-        super(MockDomainService, self).__init__('MockDomainService', *args,
-                                                **kwargs)
         self.mockupEntries = []
+        self.throw_auth_fault = False
 
     def mockup(self, records):
 
@@ -67,6 +65,9 @@ class MockDomainService(DomainService):
     # Skips authentication layer and returns the entries loaded by "Mockup"
     def get_info(self, domain_name):
 
+        if self.throw_auth_fault:
+            self.raiseInvalidAuth()
+
         # Special 'domain' to trigger error
         if str(domain_name) == str('notfound.unit.tests'):
             self.raiseZoneNotFound()
@@ -140,7 +141,7 @@ N4OiVz1I3rbZGYa396lpxO6ku8yCglisL1yrSP6DdEUp66ntpKVd
             TransipProvider('test', 'unittest')
 
         self.assertEquals(
-            str('Missing `key` of `key_file` parameter in config'),
+            str('Missing `key` or `key_file` parameter in config'),
             str(ctx.exception))
 
         TransipProvider('test', 'unittest', key=self.bogus_key)
@@ -155,6 +156,8 @@ N4OiVz1I3rbZGYa396lpxO6ku8yCglisL1yrSP6DdEUp66ntpKVd
         # Live test against API, will fail in an unauthorized error
         with self.assertRaises(WebFault) as ctx:
             provider = TransipProvider('test', 'unittest', self.bogus_key)
+            provider._client = MockDomainService('unittest', self.bogus_key)
+            provider._client.throw_auth_fault = True
             zone = Zone('unit.tests.', [])
             provider.populate(zone, True)