diff --git a/app/controllers/concerns/authentication.rb b/app/controllers/concerns/authentication.rb
index 05efbf4fc..a269fc2d6 100644
--- a/app/controllers/concerns/authentication.rb
+++ b/app/controllers/concerns/authentication.rb
@@ -57,10 +57,14 @@ module Authentication
 
     def authenticate_by_bearer_token
       if request.authorization.to_s.include?("Bearer")
-        authenticate_or_request_with_http_token do |token|
-          if identity = Identity.find_by_permissable_access_token(token, method: request.method)
-            Current.identity = identity
+        if request.format.json?
+          authenticate_or_request_with_http_token do |token|
+            if identity = Identity.find_by_permissable_access_token(token, method: request.method)
+              Current.identity = identity
+            end
           end
+        else
+          request_http_token_authentication
         end
       end
     end
diff --git a/test/controllers/users_controller_test.rb b/test/controllers/users_controller_test.rb
index 094a2310c..7fd9fd28d 100644
--- a/test/controllers/users_controller_test.rb
+++ b/test/controllers/users_controller_test.rb
@@ -145,6 +145,26 @@ class UsersControllerTest < ActionDispatch::IntegrationTest
     assert_response :no_content
   end
 
+  test "bearer token does not authenticate HTML requests" do
+    sign_in_as :jason
+    sign_out
+
+    bearer = { "HTTP_AUTHORIZATION" => "Bearer #{identity_access_tokens(:jasons_api_token).token}" }
+    get user_path(users(:jason)), env: bearer
+
+    assert_response :unauthorized
+  end
+
+  test "bearer token authenticates JSON requests" do
+    sign_in_as :jason
+    sign_out
+
+    bearer = { "HTTP_AUTHORIZATION" => "Bearer #{identity_access_tokens(:jasons_api_token).token}" }
+    get user_path(users(:jason)), env: bearer, as: :json
+
+    assert_response :success
+  end
+
   test "index avoids N+1 queries on identity" do
     sign_in_as :kevin