diff --git a/radar-auth/src/main/java/org/radarbase/auth/token/RadarToken.kt b/radar-auth/src/main/java/org/radarbase/auth/token/RadarToken.kt
index ba0511b28..d9c99950b 100644
--- a/radar-auth/src/main/java/org/radarbase/auth/token/RadarToken.kt
+++ b/radar-auth/src/main/java/org/radarbase/auth/token/RadarToken.kt
@@ -98,7 +98,7 @@ interface RadarToken {
      * @return true if the client credentials flow was certainly used, false otherwise.
      */
     val isClientCredentials: Boolean
-        get() = grantType == CLIENT_CREDENTIALS || subject == clientId
+        get() = grantType == CLIENT_CREDENTIALS || (subject != null && subject == clientId)
 
     fun copyWithRoles(roles: Set<AuthorityReference>): RadarToken