diff --git a/src/user_engine/adapters/provisioning.py b/src/user_engine/adapters/provisioning.py
index 1df4225..ecbdec7 100644
--- a/src/user_engine/adapters/provisioning.py
+++ b/src/user_engine/adapters/provisioning.py
@@ -13,7 +13,9 @@ from user_engine.ports import ProvisioningRequest, ProvisioningResult
 class HTTPIdentityProvisioningAdapter:
     def __init__(self, *, base_url: str, bearer_token: str, timeout: float = 10) -> None:
         self.base_url = base_url.rstrip("/")
-        self.bearer_token = bearer_token
+        self.bearer_token = bearer_token.strip()
+        if not self.bearer_token:
+            raise ValueError("bearer token must not be empty")
         self.timeout = timeout
 
     def provision(self, request: ProvisioningRequest) -> ProvisioningResult:
diff --git a/tests/test_provisioning_adapter.py b/tests/test_provisioning_adapter.py
index 12852ea..84ec4e1 100644
--- a/tests/test_provisioning_adapter.py
+++ b/tests/test_provisioning_adapter.py
@@ -22,7 +22,7 @@ class ProvisioningAdapterTests(unittest.TestCase):
             "resumed": True,
         }).encode())
         adapter = HTTPIdentityProvisioningAdapter(
-            base_url="http://provisioner", bearer_token="secret"
+            base_url="http://provisioner", bearer_token="secret\n"
         )
         result = adapter.provision(ProvisioningRequest(
             user_id="person-1",