diff --git a/full/src/test/java/de/ids_mannheim/korap/authentication/APIAuthenticationTest.java b/full/src/test/java/de/ids_mannheim/korap/authentication/APIAuthenticationTest.java
new file mode 100644
index 0000000..b1d43fa
--- /dev/null
+++ b/full/src/test/java/de/ids_mannheim/korap/authentication/APIAuthenticationTest.java
@@ -0,0 +1,48 @@
+package de.ids_mannheim.korap.authentication;
+
+import static org.junit.Assert.assertEquals;
+
+import java.io.IOException;
+import java.util.HashMap;
+import java.util.Map;
+
+import org.junit.Test;
+import org.springframework.beans.factory.annotation.Autowired;
+
+import de.ids_mannheim.korap.config.Attributes;
+import de.ids_mannheim.korap.config.KustvaktConfiguration;
+import de.ids_mannheim.korap.config.SpringJerseyTest;
+import de.ids_mannheim.korap.config.TokenType;
+import de.ids_mannheim.korap.exceptions.KustvaktException;
+import de.ids_mannheim.korap.user.KorAPUser;
+import de.ids_mannheim.korap.user.TokenContext;
+import de.ids_mannheim.korap.user.User;
+
+public class APIAuthenticationTest extends SpringJerseyTest {
+
+    @Autowired
+    private KustvaktConfiguration config;
+
+    @Test
+    public void testCreateGetTokenContext ()
+            throws KustvaktException, IOException, InterruptedException {
+        User user = new KorAPUser();
+        user.setUsername("testUser");
+
+        Map<String, Object> attr = new HashMap<>();
+        attr.put(Attributes.HOST, "localhost");
+        attr.put(Attributes.USER_AGENT, "java");
+
+        APIAuthentication auth = new APIAuthentication(config);
+        TokenContext context = auth.createTokenContext(user, attr);
+
+        // get token context
+        String authToken = context.getToken();
+        context = auth.getTokenContext(authToken);
+
+        TokenType tokenType = context.getTokenType();
+        assertEquals(TokenType.API, tokenType);
+        assertEquals("testUser", context.getUsername());
+    }
+
+}
diff --git a/full/src/test/java/de/ids_mannheim/korap/web/service/full/VirtualCorpusServiceTest.java b/full/src/test/java/de/ids_mannheim/korap/web/service/full/VirtualCorpusServiceTest.java
index e174d02..cb83753 100644
--- a/full/src/test/java/de/ids_mannheim/korap/web/service/full/VirtualCorpusServiceTest.java
+++ b/full/src/test/java/de/ids_mannheim/korap/web/service/full/VirtualCorpusServiceTest.java
@@ -3,6 +3,10 @@
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertTrue;
 
+import java.io.BufferedReader;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.InputStreamReader;
 import java.util.List;
 import java.util.Map.Entry;
 import java.util.Set;
@@ -18,6 +22,7 @@
 
 import de.ids_mannheim.korap.authentication.http.HttpAuthorizationHandler;
 import de.ids_mannheim.korap.config.Attributes;
+import de.ids_mannheim.korap.config.AuthenticationScheme;
 import de.ids_mannheim.korap.config.SpringJerseyTest;
 import de.ids_mannheim.korap.exceptions.KustvaktException;
 import de.ids_mannheim.korap.exceptions.StatusCodes;
@@ -29,7 +34,6 @@
     private HttpAuthorizationHandler handler;
 
     @Test
-    //    @Ignore
     public void testStoreVC () throws KustvaktException {
         String json =
                 "{\"name\": \"new vc\",\"type\": \"PRIVATE\",\"createdBy\": "
@@ -37,8 +41,8 @@
 
         ClientResponse response = resource().path("vc").path("store")
                 .header(Attributes.AUTHORIZATION,
-                        handler.createBasicAuthorizationHeaderValue(
-                                "user","pass"))
+                        handler.createBasicAuthorizationHeaderValue("user",
+                                "pass"))
                 .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32").entity(json)
                 .post(ClientResponse.class);
         String entity = response.getEntity(String.class);
@@ -46,6 +50,31 @@
     }
 
     @Test
+    public void testStoreVCWithExpiredToken () throws IOException, KustvaktException {
+        String json =
+                "{\"name\": \"new vc\",\"type\": \"PRIVATE\",\"createdBy\": "
+                        + "\"test class\",\"collectionQuery\": \"corpusSigle=GOE\"}";
+
+        InputStream is = getClass().getClassLoader().getResourceAsStream("test-user.token");
+        BufferedReader reader = new BufferedReader(new InputStreamReader(is));
+
+        String authToken = reader.readLine();
+        
+        ClientResponse response = resource().path("vc").path("store")
+                .header(Attributes.AUTHORIZATION,
+                        AuthenticationScheme.API.displayName() + " "
+                                + authToken)
+                .header(HttpHeaders.X_FORWARDED_FOR, "149.27.0.32").entity(json)
+                .post(ClientResponse.class);
+        String entity = response.getEntity(String.class);
+
+        JsonNode node = JsonUtils.readTree(entity);
+        assertEquals(StatusCodes.EXPIRED, node.at("/errors/0/0").asInt());
+        assertEquals("Authentication token is expired",
+                node.at("/errors/0/1").asText());
+    }
+
+    @Test
     public void testStoreVCUnauthorized () throws KustvaktException {
         String json =
                 "{\"name\": \"new vc\",\"type\": \"PRIVATE\",\"createdBy\": "
diff --git a/full/src/test/resources/kustvakt-test.conf b/full/src/test/resources/kustvakt-test.conf
index b16b08e..082817d 100644
--- a/full/src/test/resources/kustvakt-test.conf
+++ b/full/src/test/resources/kustvakt-test.conf
@@ -23,6 +23,7 @@
 default.layer.c = corenlp
 
 ## availability regex
+## only support |
 availability.regex.free = CC-BY.*
 availability.regex.public = ACA.* | QAO-NC
 availability.regex.all = QAO.*
@@ -50,6 +51,7 @@
 security.validation.stringLength = 150
 security.validation.emailLength = 50
 security.encryption.algo=BCRYPT
+security.sharedSecret=testSecret
 
 ## applicable: rewrite, foundry, filter, deny
 security.rewrite.strategies=filter, foundry, rewrite
\ No newline at end of file
diff --git a/full/src/test/resources/test-user.token b/full/src/test/resources/test-user.token
new file mode 100644
index 0000000..665b76d
--- /dev/null
+++ b/full/src/test/resources/test-user.token
@@ -0,0 +1 @@
+eyJhbGciOiJIUzI1NiJ9.eyJleHAiOjE1MTMwOTYwMjA0NjYsInN1YiI6InRlc3RVc2VyIiwiaXNzIjoiaHR0cDpcL1wva29yYXAuaWRzLW1hbm5oZWltLmRlIn0.n4BhCXsFMizEHepNK5AnF32a3kxyvgiesth74ZHimEY
\ No newline at end of file