diff --git a/identity-provisioner/server.py b/identity-provisioner/server.py
index ade59b0..ec316d6 100644
--- a/identity-provisioner/server.py
+++ b/identity-provisioner/server.py
@@ -48,7 +48,9 @@ def main():
         base_url=os.environ["LLDAP_URL"],
         admin_password=os.environ["LLDAP_ADMIN_PASSWORD"],
     )
-    Handler.service_token = os.environ["PROVISIONER_SERVICE_TOKEN"]
+    Handler.service_token = os.environ["PROVISIONER_SERVICE_TOKEN"].strip()
+    if not Handler.service_token:
+        raise ValueError("PROVISIONER_SERVICE_TOKEN must not be empty")
     ThreadingHTTPServer(("0.0.0.0", 8080), Handler).serve_forever()