diff --git a/awx/api/serializers.py b/awx/api/serializers.py
index eeac81071b..7fe0897805 100644
--- a/awx/api/serializers.py
+++ b/awx/api/serializers.py
@@ -1712,7 +1712,7 @@ class JobLaunchSerializer(BaseSerializer):
         if obj and hasattr(view, '_raw_data_form_marker'):
             if obj.passwords_needed_to_start:
                 password_keys = dict([(p, u'') for p in obj.passwords_needed_to_start])
-                res.update(dict(extra_vars=password_keys))
+                res.update(password_keys)
             if self.get_credential_needed_to_start(obj) is True:
                 res.update(dict(credential=''))
         return res
@@ -1733,6 +1733,20 @@ class JobLaunchSerializer(BaseSerializer):
         attrs[source] = credential
         return attrs
 
+    def validate_passwords_needed_to_start(self, attrs, source):
+        obj = self.context.get('obj')
+        passwords = self.context.get('passwords')
+        data = self.context.get('data')
+
+        # fill passwords dict with request data passwords
+        if obj.passwords_needed_to_start:
+            try:
+                for p in obj.passwords_needed_to_start:
+                    passwords[p] = data.get(p)
+            except KeyError:
+                raise serializers.ValidationError(obj.passwords_needed_to_start)
+        return attrs
+
     def validate_extra_vars(self, attrs, source):
         extra_vars = attrs.get(source, {})
         if not extra_vars:
diff --git a/awx/api/views.py b/awx/api/views.py
index 3c87ba613f..699f816e9f 100644
--- a/awx/api/views.py
+++ b/awx/api/views.py
@@ -1448,7 +1448,8 @@ class JobTemplateLaunch(RetrieveAPIView, GenericAPIView):
         if 'credential' not in request.DATA and 'credential_id' in request.DATA:
             request.DATA['credential'] = request.DATA['credential_id']
 
-        serializer = self.serializer_class(data=request.DATA, context={'obj': obj})
+        passwords = {}
+        serializer = self.serializer_class(data=request.DATA, context={'obj': obj, 'data': request.DATA, 'passwords': passwords})
         if not serializer.is_valid():
             return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST)
 
@@ -1456,6 +1457,8 @@ class JobTemplateLaunch(RetrieveAPIView, GenericAPIView):
             'credential': serializer.object.credential.pk,
             'extra_vars': serializer.object.extra_vars
         }
+        kv.update(passwords)
+
         new_job = obj.create_unified_job(**kv)
         result = new_job.signal_start(**kv)
         if not result: