diff --git a/src/main/java/com/commafeed/frontend/auth/SecurityCheckProvider.java b/src/main/java/com/commafeed/frontend/auth/SecurityCheckProvider.java
index 5c9ec996..de5b2f70 100644
--- a/src/main/java/com/commafeed/frontend/auth/SecurityCheckProvider.java
+++ b/src/main/java/com/commafeed/frontend/auth/SecurityCheckProvider.java
@@ -91,7 +91,7 @@ public class SecurityCheckProvider implements InjectableProvider<SecurityCheck,
 		}
 
 		private Optional<User> apiKeyLogin(HttpContext c) {
-			String apiKey = c.getUriInfo().getPathParameters().getFirst("apiKey");
+			String apiKey = c.getUriInfo().getQueryParameters().getFirst("apiKey");
 			if (apiKey != null && apiKeyAllowed) {
 				return userService.login(apiKey);
 			}