diff --git a/packages/server/src/middleware/authenticated.js b/packages/server/src/middleware/authenticated.js
index e2061c8eb5..e4e678abad 100644
--- a/packages/server/src/middleware/authenticated.js
+++ b/packages/server/src/middleware/authenticated.js
@@ -29,7 +29,8 @@ module.exports = async (ctx, next) => {
   if (!isClient(ctx)) {
     token = ctx.cookies.get(getCookieName())
     authType = AuthTypes.BUILDER
-  } else if (appId) {
+  }
+  if (!token && appId) {
     token = ctx.cookies.get(getCookieName(appId))
     authType = AuthTypes.APP
   }