diff --git a/src/main/java/org/radarbase/management/config/ManagementPortalProperties.java b/src/main/java/org/radarbase/management/config/ManagementPortalProperties.java
index 84436f417..d004469b3 100644
--- a/src/main/java/org/radarbase/management/config/ManagementPortalProperties.java
+++ b/src/main/java/org/radarbase/management/config/ManagementPortalProperties.java
@@ -20,6 +20,8 @@ public class ManagementPortalProperties {
 
     private final CatalogueServer catalogueServer = new CatalogueServer();
 
+    private final Account account = new Account();
+
     public ManagementPortalProperties.Frontend getFrontend() {
         return frontend;
     }
@@ -44,6 +46,22 @@ public Common getCommon() {
         return common;
     }
 
+    public Account getAccount() {
+        return account;
+    }
+
+    public static class Account {
+        private boolean enableExposeToken = false;
+
+        public boolean getEnableExposeToken() {
+            return enableExposeToken;
+        }
+
+        public void setEnableExposeToken(boolean enableExposeToken) {
+            this.enableExposeToken = enableExposeToken;
+        }
+    }
+
     public static class Common {
 
         private String baseUrl = "";
diff --git a/src/main/java/org/radarbase/management/web/rest/AccountResource.java b/src/main/java/org/radarbase/management/web/rest/AccountResource.java
index de8d8cac4..c9f959762 100644
--- a/src/main/java/org/radarbase/management/web/rest/AccountResource.java
+++ b/src/main/java/org/radarbase/management/web/rest/AccountResource.java
@@ -132,7 +132,9 @@ public UserDTO getAccount() {
                         "Cannot get account without user", USER, ERR_ACCESS_DENIED));
 
         UserDTO userDto = userMapper.userToUserDTO(currentUser);
-        userDto.setAccessToken(token.getToken());
+        if (managementPortalProperties.getAccount().getEnableExposeToken()) {
+            userDto.setAccessToken(token.getToken());
+        }
         return userDto;
     }
 
diff --git a/src/main/resources/config/application.yml b/src/main/resources/config/application.yml
index 841f4a5f4..dca3c7541 100644
--- a/src/main/resources/config/application.yml
+++ b/src/main/resources/config/application.yml
@@ -106,6 +106,8 @@ info:
 #
 # ===================================================================
 managementportal:
+    account:
+        enableExposeToken: false
     mail: # specific JHipster mail property, for standard properties see MailProperties
         from: ManagementPortal@localhost
     oauth: