diff --git a/reposilite-backend/src/main/java/org/panda_lang/reposilite/repository/LookupApiController.java b/reposilite-backend/src/main/java/org/panda_lang/reposilite/repository/LookupApiController.java
index 7be8d60f7..d8c8f6c2b 100644
--- a/reposilite-backend/src/main/java/org/panda_lang/reposilite/repository/LookupApiController.java
+++ b/reposilite-backend/src/main/java/org/panda_lang/reposilite/repository/LookupApiController.java
@@ -62,13 +62,13 @@ public Context handleContext(Context ctx) {
         ReposiliteContext context = contextFactory.create(ctx);
         Reposilite.getLogger().info("API " + context.uri() + " from " + context.address());
 
-        String uri = ReposiliteUtils.normalizeUri(rewritePathsEnabled, repositoryService, StringUtils.replaceFirst(ctx.req.getRequestURI(), "/api", ""));
+        String uri = ReposiliteUtils.normalizeUri(rewritePathsEnabled, repositoryService, StringUtils.replaceFirst(context.uri(), "/api", ""));
 
         if (StringUtils.isEmpty(uri) || "/".equals(uri)) {
-            return ctx.json(lookupService.findAvailableRepositories(ctx.headerMap()));
+            return ctx.json(lookupService.findAvailableRepositories(context.headers()));
         }
 
-        Result<Pair<String[], Repository>, ErrorDto> result = repositoryAuthenticator.authRepository(ctx.headerMap(), ctx.req.getRequestURI(), uri);
+        Result<Pair<String[], Repository>, ErrorDto> result = repositoryAuthenticator.authRepository(context.headers(), uri);
 
         if (result.containsError()) {
             return ResponseUtils.errorResponse(ctx, result.getError().getStatus(), result.getError().getMessage());
diff --git a/reposilite-backend/src/main/java/org/panda_lang/reposilite/repository/RepositoryAuthenticator.java b/reposilite-backend/src/main/java/org/panda_lang/reposilite/repository/RepositoryAuthenticator.java
index dc6ca0fb1..94987e82b 100644
--- a/reposilite-backend/src/main/java/org/panda_lang/reposilite/repository/RepositoryAuthenticator.java
+++ b/reposilite-backend/src/main/java/org/panda_lang/reposilite/repository/RepositoryAuthenticator.java
@@ -41,10 +41,10 @@ public RepositoryAuthenticator(boolean rewritePathsEnabled, Authenticator authen
     }
 
     public Result<Pair<String[], Repository>, ErrorDto> authDefaultRepository(Map<String, String> headers, String uri) {
-        return authRepository(headers, uri, ReposiliteUtils.normalizeUri(rewritePathsEnabled, repositoryService, uri));
+        return authRepository(headers, ReposiliteUtils.normalizeUri(rewritePathsEnabled, repositoryService, uri));
     }
 
-    public Result<Pair<String[], Repository>, ErrorDto> authRepository(Map<String, String> headers, String uri, String normalizedUri) {
+    public Result<Pair<String[], Repository>, ErrorDto> authRepository(Map<String, String> headers, String normalizedUri) {
         String[] path = StringUtils.split(normalizedUri, "/");
         String repositoryName = path[0];
 
@@ -60,7 +60,7 @@ public Result<Pair<String[], Repository>, ErrorDto> authRepository(Map<String, S
 
         // auth hidden repositories
         if (repository.isHidden()) {
-            Result<Session, String> authResult = authenticator.authByUri(headers, uri);
+            Result<Session, String> authResult = authenticator.authByUri(headers, normalizedUri);
 
             if (authResult.containsError()) {
                 return ResponseUtils.error(HttpStatus.SC_UNAUTHORIZED, "Unauthorized request");
diff --git a/reposilite-backend/src/test/groovy/org/panda_lang/reposilite/repository/RepositoryAuthenticatorTest.groovy b/reposilite-backend/src/test/groovy/org/panda_lang/reposilite/repository/RepositoryAuthenticatorTest.groovy
index 7f2eae241..f16e3fee5 100644
--- a/reposilite-backend/src/test/groovy/org/panda_lang/reposilite/repository/RepositoryAuthenticatorTest.groovy
+++ b/reposilite-backend/src/test/groovy/org/panda_lang/reposilite/repository/RepositoryAuthenticatorTest.groovy
@@ -29,7 +29,7 @@ class RepositoryAuthenticatorTest extends AuthenticatorSpecification {
 
     @Test
     void 'should not auth invalid repository uri' () {
-        assertEquals "Unsupported request", REPOSITORY_AUTHENTICATOR.authRepository([:], '', '').getError().getMessage()
+        assertEquals "Unsupported request", REPOSITORY_AUTHENTICATOR.authRepository([:], '').getError().getMessage()
     }
 
 }
diff --git a/reposilite-backend/src/test/workspace/access.md b/reposilite-backend/src/test/workspace/access.md
index ff3b5dca9..61da59938 100644
--- a/reposilite-backend/src/test/workspace/access.md
+++ b/reposilite-backend/src/test/workspace/access.md
@@ -9,5 +9,9 @@ path: /releases/auth/test
 alias: authtest
 token: GPrV9j2xkh9i6PLvXuz7Of_ofmnxVJjn7GRBuTAQfCfhVlKzAEhzc6wjmcC8CGML
 
+path: /private
+alias: private
+token: 6U8GaizE0udSuk9ADVhcUXBUPNqZg46L55JN9XYdtwC21cNMubP8x9ez+/I8Q/Bn
+
 SSL password: reposilite
 ```
\ No newline at end of file
diff --git a/reposilite-backend/src/test/workspace/tokens.dat b/reposilite-backend/src/test/workspace/tokens.dat
index 0b6f79f43..8bb68b2e3 100644
--- a/reposilite-backend/src/test/workspace/tokens.dat
+++ b/reposilite-backend/src/test/workspace/tokens.dat
@@ -1,8 +1,14 @@
-!!org.panda_lang.reposilite.auth.TokensCollection
+!!org.panda_lang.reposilite.auth.TokenCollection
 "tokens":
+- "alias": "private"
+  "path": "/private"
+  "permissions": "w"
+  "token": "$2a$10$emGPCUwsR650EJYNrjy/tucpi2rA0O2oYTT87OYQU9bSodGlNrI.q"
 - "alias": "authtest"
   "path": "/releases/auth/test"
+  "permissions": "w"
   "token": "$2a$10$gQ9/kwYOl9T1zgGlfFPyMuFdb2fd5of7nhDK4TS26A7yYZiVfiuSi"
 - "alias": "admin"
   "path": "/"
+  "permissions": "w"
   "token": "$2a$10$Rb2m1vYj7CIW9ve.twvabOMtSp3vnkrsqd08F2Edi3.kGnqjTcWmy"