diff --git a/src/services/wiki/plugin/ipcSyncAdaptor/fix-location-info.ts b/src/services/wiki/plugin/ipcSyncAdaptor/fix-location-info.ts
index 30d2efe5..550649b2 100644
--- a/src/services/wiki/plugin/ipcSyncAdaptor/fix-location-info.ts
+++ b/src/services/wiki/plugin/ipcSyncAdaptor/fix-location-info.ts
@@ -83,7 +83,7 @@ function getInfoTiddlerFields(updateInfoTiddlersCallback: (infos: Array<{ text:
       }
 
       // Add workspace token for QR code (if available)
-      if (authToken) {
+      if (tokenAuth && authToken) {
         asyncInfoTiddlerFields.push({ title: '$:/info/tidgi/workspaceToken', text: authToken });
       }
 
diff --git a/src/services/workspaces/__tests__/tokenAuth.test.ts b/src/services/workspaces/__tests__/tokenAuth.test.ts
new file mode 100644
index 00000000..51447ba9
--- /dev/null
+++ b/src/services/workspaces/__tests__/tokenAuth.test.ts
@@ -0,0 +1,50 @@
+import { SupportedStorageServices } from '@services/types';
+import { describe, expect, it, vi } from 'vitest';
+import { Workspace } from '../index';
+import { type IWikiWorkspace, wikiWorkspaceDefaultValues } from '../interface';
+
+vi.mock('../registerMenu', () => ({
+  registerMenu: vi.fn(),
+}));
+
+function createWorkspace(overrides: Partial<IWikiWorkspace>): IWikiWorkspace {
+  return {
+    ...wikiWorkspaceDefaultValues,
+    id: 'workspace-1',
+    name: 'Workspace 1',
+    wikiFolderLocation: '/tmp/workspace-1',
+    isSubWiki: false,
+    mainWikiID: null,
+    mainWikiToLink: null,
+    pageType: null,
+    picturePath: null,
+    homeUrl: 'tidgi://workspace-1',
+    gitUrl: null,
+    storageService: SupportedStorageServices.local,
+    tagNames: [],
+    userName: 'tester',
+    ...overrides,
+  };
+}
+
+function createWorkspaceService(workspace: IWikiWorkspace): Workspace {
+  const service = new Workspace() as Workspace & { workspaces?: Record<string, IWikiWorkspace> };
+  service.workspaces = { [workspace.id]: workspace };
+  return service;
+}
+
+describe('Workspace token auth', () => {
+  it('should not expose workspace token when token auth is disabled', async () => {
+    const service = createWorkspaceService(createWorkspace({ authToken: 'secret-token', tokenAuth: false }));
+
+    await expect(service.getWorkspaceToken('workspace-1')).resolves.toBeUndefined();
+    await expect(service.validateWorkspaceToken('workspace-1', 'secret-token')).resolves.toBe(false);
+  });
+
+  it('should expose workspace token when token auth is enabled', async () => {
+    const service = createWorkspaceService(createWorkspace({ authToken: 'secret-token', tokenAuth: true }));
+
+    await expect(service.getWorkspaceToken('workspace-1')).resolves.toBe('secret-token');
+    await expect(service.validateWorkspaceToken('workspace-1', 'secret-token')).resolves.toBe(true);
+  });
+});
diff --git a/src/services/workspaces/index.ts b/src/services/workspaces/index.ts
index 347d9907..59ac3df2 100644
--- a/src/services/workspaces/index.ts
+++ b/src/services/workspaces/index.ts
@@ -762,7 +762,7 @@ export class Workspace implements IWorkspaceService {
    */
   public async getWorkspaceToken(workspaceId: string): Promise<string | undefined> {
     const workspace = this.getSync(workspaceId);
-    if (!workspace || !isWikiWorkspace(workspace)) {
+    if (!workspace || !isWikiWorkspace(workspace) || !workspace.tokenAuth) {
       return undefined;
     }
     return workspace.authToken;