diff --git a/src/seedpass/api.py b/src/seedpass/api.py
index 110a7d12..a22ff7bd 100644
--- a/src/seedpass/api.py
+++ b/src/seedpass/api.py
@@ -25,7 +25,8 @@ _token: str = ""
 
 
 def _check_token(auth: str | None) -> None:
-    if auth != f"Bearer {_token}":
+    expected = f"Bearer {_token}"
+    if auth is None or not secrets.compare_digest(auth, expected):
         raise HTTPException(status_code=401, detail="Unauthorized")
 
 
diff --git a/src/tests/test_api.py b/src/tests/test_api.py
index 6d0db7fc..d1470415 100644
--- a/src/tests/test_api.py
+++ b/src/tests/test_api.py
@@ -65,6 +65,16 @@ def test_invalid_token(client):
     assert res.status_code == 401
 
 
+def test_missing_token(client):
+    cl, _token = client
+    # No Authorization header
+    res = cl.get(
+        "/api/v1/entry",
+        params={"query": "s"},
+    )
+    assert res.status_code == 401
+
+
 def test_get_entry_by_id(client):
     cl, token = client
     headers = {