diff --git a/tests/integration/test_workflow.py b/tests/integration/test_workflow.py
index b88c5b808..2aa29766c 100644
--- a/tests/integration/test_workflow.py
+++ b/tests/integration/test_workflow.py
@@ -196,11 +196,17 @@ def test_metadata_discovery_publish():
         r = r.json()
         assert r['conformsTo'][0] == 'http://wis.wmo.int/spec/wcmp/2/conf/core'
 
-        r = SESSION.get(f'{API_URL}/collections/discovery-metadata/items/urn:wmo:md:cd-brazza_met_centre:surface-weather-observations').json()  # noqa
+        id_ = 'urn:wmo:md:cd-brazza_met_centre:surface-weather-observations'
+        r = SESSION.get(f'{API_URL}/collections/discovery-metadata/items/{id_}').json()  # noqa
 
         assert 'has_auth' in r['wis2box']
         assert r['wis2box']['has_auth']
 
+        for link in r['links']:
+            if link['rel'] == 'collection' and link['title'] == id_:
+                assert link['security']['default']['type'] == 'http'
+                assert link['security']['default']['scheme'] == 'bearer'
+
 
 def test_data_ingest():
     """Test data ingest/process publish"""
diff --git a/wis2box-management/wis2box/auth.py b/wis2box-management/wis2box/auth.py
index 9c96f0ee7..6d4f46961 100644
--- a/wis2box-management/wis2box/auth.py
+++ b/wis2box-management/wis2box/auth.py
@@ -181,6 +181,17 @@ def add_token(ctx, metadata_id, path, yes, token):
         record = oar.collection_item('discovery-metadata', metadata_id)
         record['wis2box']['has_auth'] = True
 
+        for link in record['links']:
+            if link['rel'] == 'collection' and link['title'] == metadata_id:
+                LOGGER.debug('Adding security object to link')
+                link['security'] = {
+                    'default': {
+                        'type': 'http',
+                        'scheme': 'bearer',
+                        'description': 'Please contact the data provider for access'  # noqa
+                    }
+                }
+
         upsert_collection_item('discovery-metadata', record)
 
 
@@ -212,6 +223,9 @@ def remove_token(ctx, metadata_id, path, token):
 
         record = oar.collection_item('discovery-metadata', metadata_id)
         record['wis2box'].pop('has_auth', None)
+        for link in record['links']:
+            if 'security' in link:
+                link.pop('security', None)
 
         upsert_collection_item('discovery-metadata', record)