diff --git a/oauth2client/appengine.py b/oauth2client/appengine.py
index e055216..5cd3f4b 100644
--- a/oauth2client/appengine.py
+++ b/oauth2client/appengine.py
@@ -575,16 +575,31 @@
     self._tls.credentials = credentials
 
   def get_credentials(self):
-    return self._tls.credentials
+    """A thread local Credentials object.
+
+    Returns:
+      A client.Credentials object, or None if credentials hasn't been set in
+      this thread yet, which may happen when calling has_credentials inside
+      oauth_aware.
+    """
+    return getattr(self._tls, 'credentials', None)
+
+  credentials = property(get_credentials, set_credentials)
 
   def set_flow(self, flow):
     self._tls.flow = flow
 
   def get_flow(self):
-    return self._tls.flow
+    """A thread local Flow object.
+
+    Returns:
+      A credentials.Flow object, or None if the flow hasn't been set in this
+      thread yet, which happens in _create_flow() since Flows are created
+      lazily.
+    """
+    return getattr(self._tls, 'flow', None)
 
   flow = property(get_flow, set_flow)
-  credentials = property(get_credentials, set_credentials)
 
 
   @util.positional(4)
diff --git a/tests/test_oauth2client_appengine.py b/tests/test_oauth2client_appengine.py
index 79657e0..4b2c414 100644
--- a/tests/test_oauth2client_appengine.py
+++ b/tests/test_oauth2client_appengine.py
@@ -505,6 +505,8 @@
   def test_required(self):
     # An initial request to an oauth_required decorated path should be a
     # redirect to start the OAuth dance.
+    self.assertEqual(self.decorator.flow, None)
+    self.assertEqual(self.decorator.credentials, None)
     response = self.app.get('http://localhost/foo_path')
     self.assertTrue(response.status.startswith('302'))
     q = parse_qs(response.headers['Location'].split('?', 1)[1])