diff --git a/app.py b/app.py
index 009e516..1f637cd 100755
--- a/app.py
+++ b/app.py
@@ -112,7 +112,7 @@ async def api_v2(request: Request, endpoint: dict) -> Response:
     print("REMOVE ME", auth_ok, device_id, topic_name, response_message, status_code)
     # We assume device data is valid here
     logging.debug(pprint.pformat(request_data))
-    if topic_name:
+    if auth_ok and topic_name:
         if app.producer:
             logging.info(f'Sending path "{path}" data to {topic_name}')
             packed_data = data_pack(request_data)
diff --git a/tests/test_api2.py b/tests/test_api2.py
index f978cb4..878db21 100644
--- a/tests/test_api2.py
+++ b/tests/test_api2.py
@@ -1,12 +1,76 @@
-import json
+import logging
 import os
 from datetime import datetime, timedelta, timezone
 
 import httpx
 
+logging.basicConfig(level=logging.INFO)
+
 API_BASE_URL = os.getenv("API_BASE_URL", "http://localhost:8001")
 API_TOKEN = os.getenv("API_TOKEN", "abc123")
 
+THINGPARK_HEADERS = {
+    "Content-Type": "application/json",
+    "Accept": "*/*",
+    "Connection": "close",
+    "X-Real-Ip": "52.16.83.187",
+    "X-Forwarded-For": "52.16.83.187",
+    "X-Forwarded-Proto": "https",
+    "User-Agent": "ACTILITY-LRCLRN-DEVICE-AGENT/1.0",
+}
+# query params
+THINGPARK_PARAMS = {
+    "x-api-key": API_TOKEN,
+    "LrnDevEui": "70B3D57050011422",
+    "LrnFPort": "2",
+    "LrnInfos": "TWA_100002581.57949.AS-1-556889314",
+}
+# Body
+THINGPARK_PAYLOAD = {
+    "DevEUI_uplink": {
+        "Time": "2022-02-24T16:23:17.468+00:00",
+        "DevEUI": "70B3D57050011422",
+        "FPort": 20,
+        "FCntUp": 3866,
+        "ADRbit": 1,
+        "MType": 4,
+        "FCntDn": 3900,
+        "payload_hex": "901429c204282705",
+        "mic_hex": "3af4037a",
+        "Lrcid": "00000201",
+        "LrrRSSI": -113.000000,
+        "LrrSNR": -11.000000,
+        "LrrESP": -124.331955,
+        "SpFact": 8,
+        "SubBand": "G1",
+        "Channel": "LC1",
+        "DevLrrCnt": 1,
+        "Lrrid": "FF0109A4",
+        "Late": 0,
+        "LrrLAT": 60.242538,
+        "LrrLON": 25.211100,
+        "Lrrs": {
+            "Lrr": [
+                {
+                    "Lrrid": "FF0109A4",
+                    "Chain": 0,
+                    "LrrRSSI": -113.000000,
+                    "LrrSNR": -11.000000,
+                    "LrrESP": -124.331955,
+                }
+            ]
+        },
+        "CustomerID": "100002581",
+        "CustomerData": {"alr": {"pro": "mcf88/lw12terwp", "ver": "1"}},
+        "ModelCfg": "0",
+        "DevAddr": "E00324CA",
+        "TxPower": 14.000000,
+        "NbTrans": 1,
+        "Frequency": 868.1,
+        "DynamicClass": "A",
+    }
+}
+
 
 def test_service_up():
     url = API_BASE_URL
@@ -24,81 +88,19 @@ def test_digita_endpoint_up():
 
 def test_digita_endppoint_authenticated_access():
     url = f"{API_BASE_URL}/api/v1/digita"
-    # Create a Time string in ISO 8601 format a few seconds in the past
-    # This is to make sure that the message is not rejected because of being too old
-    # (the default is 60 seconds)
-
-    headers = {
-        "Content-Type": "application/json",
-        "Accept": "*/*",
-        "Connection": "close",
-        "X-Real-Ip": "52.16.83.187",
-        "X-Forwarded-For": "52.16.83.187",
-        "X-Forwarded-Proto": "https",
-        "User-Agent": "ACTILITY-LRCLRN-DEVICE-AGENT/1.0",
-    }
-    # query params
-    params = {
-        "token": API_TOKEN,
-        "LrnDevEui": "70B3D57050011422",
-        "LrnFPort": "2",
-        "LrnInfos": "TWA_100002581.57949.AS-1-556889314",
-    }
-    # Body
-    payload = {
-        "DevEUI_uplink": {
-            "Time": "2022-02-24T16:23:17.468+00:00",
-            "DevEUI": "70B3D57050011422",
-            "FPort": 20,
-            "FCntUp": 3866,
-            "ADRbit": 1,
-            "MType": 4,
-            "FCntDn": 3900,
-            "payload_hex": "901429c204282705",
-            "mic_hex": "3af4037a",
-            "Lrcid": "00000201",
-            "LrrRSSI": -113.000000,
-            "LrrSNR": -11.000000,
-            "LrrESP": -124.331955,
-            "SpFact": 8,
-            "SubBand": "G1",
-            "Channel": "LC1",
-            "DevLrrCnt": 1,
-            "Lrrid": "FF0109A4",
-            "Late": 0,
-            "LrrLAT": 60.242538,
-            "LrrLON": 25.211100,
-            "Lrrs": {
-                "Lrr": [
-                    {
-                        "Lrrid": "FF0109A4",
-                        "Chain": 0,
-                        "LrrRSSI": -113.000000,
-                        "LrrSNR": -11.000000,
-                        "LrrESP": -124.331955,
-                    }
-                ]
-            },
-            "CustomerID": "100002581",
-            "CustomerData": {"alr": {"pro": "mcf88/lw12terwp", "ver": "1"}},
-            "ModelCfg": "0",
-            "DevAddr": "E00324CA",
-            "TxPower": 14.000000,
-            "NbTrans": 1,
-            "Frequency": 868.1,
-            "DynamicClass": "A",
-        }
-    }
+    headers = THINGPARK_HEADERS.copy()
+    params = THINGPARK_PARAMS.copy()
+    payload = THINGPARK_PAYLOAD.copy()
     # Replace Time with ~current time
     ts = (datetime.now(timezone.utc) - timedelta(seconds=1)).strftime("%Y-%m-%dT%H:%M:%S.%f%z")
     payload["DevEUI_uplink"]["Time"] = ts
-    # convert dict to json by json.dumps() for body data.
-    resp = httpx.post(url, headers=headers, params=params, data=json.dumps(payload))
-    print(params)
-    # resp = httpx.post(url, headers=headers, params=params, data=payload)
-    print(resp.status_code)
+    resp = httpx.post(url, headers=headers, params=params, data=payload)
+    logging.info(resp.text)
     assert resp.status_code in [200, 201, 202], "message forwarded"
-    assert resp.text == "Request accepted", "message forwarded"
+    params["x-api-key"] = "wrong"
+    resp = httpx.post(url, headers=headers, params=params, data=payload)
+    logging.info(resp.text)
+    assert resp.status_code == 401, "failed as intended"
 
 
 def main():