diff --git a/trustgraph-flow/trustgraph/api/gateway/endpoint.py b/trustgraph-flow/trustgraph/api/gateway/endpoint.py
index a048c890..af7a5070 100644
--- a/trustgraph-flow/trustgraph/api/gateway/endpoint.py
+++ b/trustgraph-flow/trustgraph/api/gateway/endpoint.py
@@ -69,9 +69,9 @@ class ServiceEndpoint:
                 return web.HTTPUnauthorized()
             token = tokens[1]
         except:
-            return web.HTTPUnauthorized()
+            token = ""
 
-        if not self.auth.permitted(tokens[1], self.operation):
+        if not self.auth.permitted(token, self.operation):
             return web.HTTPUnauthorized()
 
         try:
diff --git a/trustgraph-flow/trustgraph/api/gateway/service.py b/trustgraph-flow/trustgraph/api/gateway/service.py
index 2ade18b2..a25dd9dc 100755
--- a/trustgraph-flow/trustgraph/api/gateway/service.py
+++ b/trustgraph-flow/trustgraph/api/gateway/service.py
@@ -53,7 +53,7 @@ logger.setLevel(logging.INFO)
 default_pulsar_host = os.getenv("PULSAR_HOST", "pulsar://pulsar:6650")
 default_timeout = 600
 default_port = 8088
-default_api_token = None
+default_api_token = os.getenv("GATEWAY_SECRET", "")
 
 class Api:
 
diff --git a/trustgraph-flow/trustgraph/api/gateway/socket.py b/trustgraph-flow/trustgraph/api/gateway/socket.py
index 0f5031e6..869792b7 100644
--- a/trustgraph-flow/trustgraph/api/gateway/socket.py
+++ b/trustgraph-flow/trustgraph/api/gateway/socket.py
@@ -47,7 +47,7 @@ class SocketEndpoint:
         try:
             token = request.query['token']
         except:
-            return web.HTTPUnauthorized()
+            token = ""
 
         if not self.auth.permitted(token, self.operation):
             return web.HTTPUnauthorized()