diff --git a/src/server/api.coffee b/src/server/api.coffee
index c98384f47b..09824e294c 100644
--- a/src/server/api.coffee
+++ b/src/server/api.coffee
@@ -33,6 +33,7 @@ auth = (req, res, next) ->
     req.user = user
     req.userObj = user.get()
     return res.json 401, NO_USER_FOUND if !req.userObj || _.isEmpty(req.userObj)
+    req._isServer = true
     next()
 
 router.get '/status', (req, res) ->
diff --git a/src/server/store.coffee b/src/server/store.coffee
index 659d890685..ac4ab491af 100644
--- a/src/server/store.coffee
+++ b/src/server/store.coffee
@@ -30,9 +30,7 @@ userAccess = (store) ->
     err = arguments[arguments.length - 1]
     # return err(derbyAuth.SESSION_INVALIDATED_ERROR) if derbyAuth.bustedSession(@)
 
-    # TEMPORARY token check to allow api
-    # Must fix before release
-    return accept(true)
+    return accept(true) if derbyAuth.isServer(@)
 
     return accept(false) if derbyAuth.bustedSession(@)
 
@@ -45,8 +43,7 @@ userAccess = (store) ->
       return accept(true)
 
     # Same session (user.id = this.session.userId)
-    if (uid is @session.userId) or derbyAuth.isServer(@)
-      return accept(true)
+    return accept(true) if uid is @session.userId
 
     accept(false)