diff --git a/endpoints/v2/v2auth.py b/endpoints/v2/v2auth.py
index f302d11ca..db30f6c23 100644
--- a/endpoints/v2/v2auth.py
+++ b/endpoints/v2/v2auth.py
@@ -103,6 +103,10 @@ def generate_registry_jwt():
       'actions': actions,
     })
 
+  elif user is None and token is None:
+    # In this case, we are doing an auth flow, and it's not an anonymous pull
+    return abort(401)
+
   token_data = {
     'iss': app.config['JWT_AUTH_TOKEN_ISSUER'],
     'aud': audience_param,