diff --git a/src/Application.php b/src/Application.php
index 1d2addaa6..b536e2994 100644
--- a/src/Application.php
+++ b/src/Application.php
@@ -130,9 +130,6 @@ public function middleware($middlewareQueue): MiddlewareQueue
             // Provides a `GET /status` endpoint. This must be
             ->add(new StatusMiddleware())
 
-            // Load configuration from API for the current project.
-            ->add(new ConfigurationMiddleware())
-
             // Handle plugin/theme assets like CakePHP normally does.
             ->add(new AssetMiddleware([
                 'cacheTime' => Configure::read('Asset.cacheTime'),
@@ -156,6 +153,9 @@ public function middleware($middlewareQueue): MiddlewareQueue
             // Authentication middleware.
             ->add(new OAuth2Middleware())
 
+            // Load configuration from API for the current project.
+            ->add(new ConfigurationMiddleware())
+
             // Recovery middleware
             ->add(new RecoveryMiddleware())
 
diff --git a/src/Controller/Component/ProjectConfigurationComponent.php b/src/Controller/Component/ProjectConfigurationComponent.php
index daac98e70..a32d9dd57 100644
--- a/src/Controller/Component/ProjectConfigurationComponent.php
+++ b/src/Controller/Component/ProjectConfigurationComponent.php
@@ -70,7 +70,12 @@ function () {
      */
     protected function fetchConfig(): array
     {
-        $response = (array)ApiClientProvider::getApiClient()->get('config', ['page_size' => 100]);
+        $client = ApiClientProvider::getApiClient();
+        $response = (array)$client->get('config', ['page_size' => 100], [
+            'Authorization' => sprintf('Bearer %s', Hash::get($client->getTokens(), 'jwt')),
+            'X-Api-Key' => Configure::read('API.apiKey'),
+            'Accept' => 'application/json',
+        ]);
 
         $config = Hash::combine($response, 'data.{n}.attributes.name', 'data.{n}.attributes.content');
         array_walk(
diff --git a/src/Middleware/ConfigurationMiddleware.php b/src/Middleware/ConfigurationMiddleware.php
index d23ab882d..844092b24 100644
--- a/src/Middleware/ConfigurationMiddleware.php
+++ b/src/Middleware/ConfigurationMiddleware.php
@@ -13,6 +13,7 @@
 namespace App\Middleware;
 
 use App\Utility\ApiConfigTrait;
+use BEdita\WebTools\ApiClientProvider;
 use Cake\Core\Configure;
 use Psr\Http\Message\ResponseInterface;
 use Psr\Http\Message\ServerRequestInterface;
@@ -34,6 +35,10 @@ class ConfigurationMiddleware implements MiddlewareInterface
     public function process(ServerRequestInterface $request, RequestHandlerInterface $handler): ResponseInterface
     {
         if (Configure::check('API.apiBaseUrl')) {
+            $identity = $request->getAttribute('identity');
+            if ($identity && $identity->get('tokens')) {
+                ApiClientProvider::getApiClient()->setupTokens($identity->get('tokens'));
+            }
             $this->readApiConfig();
         }
 
diff --git a/src/Utility/ApiConfigTrait.php b/src/Utility/ApiConfigTrait.php
index f6ceb9e48..812f9eabc 100644
--- a/src/Utility/ApiConfigTrait.php
+++ b/src/Utility/ApiConfigTrait.php
@@ -87,8 +87,12 @@ function () {
      */
     protected function fetchConfig(?string $key = null): array
     {
-        $query = ['page_size' => 100];
-        $response = (array)ApiClientProvider::getApiClient()->get('/config', $query);
+        $client = ApiClientProvider::getApiClient();
+        $response = (array)$client->get('/config', ['page_size' => 100], [
+            'Authorization' => sprintf('Bearer %s', Hash::get($client->getTokens(), 'jwt')),
+            'X-Api-Key' => Configure::read('API.apiKey'),
+            'Accept' => 'application/json',
+        ]);
         $collection = new Collection((array)Hash::get($response, 'data'));
 
         return $collection->reject(function ($item) use ($key) {
diff --git a/tests/TestCase/ApplicationTest.php b/tests/TestCase/ApplicationTest.php
index ca3af0609..c7dff88b8 100644
--- a/tests/TestCase/ApplicationTest.php
+++ b/tests/TestCase/ApplicationTest.php
@@ -16,6 +16,7 @@
 use App\Identifier\ApiIdentifier;
 use App\Middleware\ConfigurationMiddleware;
 use App\Middleware\ProjectMiddleware;
+use App\Middleware\RecoveryMiddleware;
 use App\Middleware\StatusMiddleware;
 use Authentication\AuthenticationService;
 use Authentication\Authenticator\AuthenticatorInterface;
@@ -26,6 +27,7 @@
 use BEdita\WebTools\Middleware\OAuth2Middleware;
 use Cake\Core\Configure;
 use Cake\Error\Middleware\ErrorHandlerMiddleware;
+use Cake\Http\Middleware\BodyParserMiddleware;
 use Cake\Http\Middleware\CsrfProtectionMiddleware;
 use Cake\Http\MiddlewareQueue;
 use Cake\Http\ServerRequest;
@@ -65,8 +67,6 @@ public function testMiddleware(): void
         $middleware->next();
         static::assertInstanceOf(StatusMiddleware::class, $middleware->current());
         $middleware->next();
-        static::assertInstanceOf(ConfigurationMiddleware::class, $middleware->current());
-        $middleware->next();
         static::assertInstanceOf(AssetMiddleware::class, $middleware->current());
         $middleware->next();
         static::assertInstanceOf(I18nMiddleware::class, $middleware->current());
@@ -78,6 +78,12 @@ public function testMiddleware(): void
         static::assertInstanceOf(AuthenticationMiddleware::class, $middleware->current());
         $middleware->next();
         static::assertInstanceOf(OAuth2Middleware::class, $middleware->current());
+        $middleware->next();
+        static::assertInstanceOf(ConfigurationMiddleware::class, $middleware->current());
+        $middleware->next();
+        static::assertInstanceOf(RecoveryMiddleware::class, $middleware->current());
+        $middleware->next();
+        static::assertInstanceOf(BodyParserMiddleware::class, $middleware->current());
     }
 
     /**