diff --git a/website/src/middlewares/api-v3/auth.js b/website/src/middlewares/api-v3/auth.js
index 65838a9a84..0de7474b6c 100644
--- a/website/src/middlewares/api-v3/auth.js
+++ b/website/src/middlewares/api-v3/auth.js
@@ -4,7 +4,7 @@ import {
 } from '../../libs/api-v3/errors';
 
 import {
-  UserModel as User,
+  model as User,
 } from '../../models/user';
 
 // TODO use i18n
@@ -27,12 +27,12 @@ export function authWithHeaders (req, res, next) {
     return next(new NotAuthorized(missingAuthHeaders));
   }
 
-  // TODO use promises?
   User.findOne({
     _id: userId,
     apiToken,
-  }, (err, user) => {
-    if (err) return next(err);
+  })
+  .exec()
+  .then((user) => {
     if (!user) return next(new NotAuthorized(userNotFound));
 
     // TODO better handling for this case
@@ -42,7 +42,8 @@ export function authWithHeaders (req, res, next) {
     // TODO use either session/cookie or headers, not both
     req.session.userId = user._id;
     return next();
-  });
+  })
+  .catch(next);
 }
 
 // Authenticate a request through a valid session
@@ -54,11 +55,13 @@ export function authWithSession (req, res, next) {
 
   User.findOne({
     _id: userId,
-  }, (err, user) => {
-    if (err) return next(err);
+  })
+  .exec()
+  .then((user) => {
     if (!user) return next(new NotAuthorized(userNotFound));
 
     res.locals.user = user;
     return next();
-  });
+  })
+  .catch(next);
 }
\ No newline at end of file
diff --git a/website/src/server.js b/website/src/server.js
index 6c626ce4b0..fad04b5ff1 100644
--- a/website/src/server.js
+++ b/website/src/server.js
@@ -39,6 +39,8 @@ if (cores!==0 && cluster.isMaster && (isDev || isProd)) {
 
   // ------------  MongoDB Configuration ------------
   var mongoose = require('mongoose');
+  // Use Q promises instead of mpromise in mongoose
+  mongoose.Promise = require('q');
   var mongooseOptions = !isProd ? {} : {
     replset: { socketOptions: { keepAlive: 1, connectTimeoutMS: 30000 } },
     server: { socketOptions: { keepAlive: 1, connectTimeoutMS: 30000 } }