diff --git a/package-lock.json b/package-lock.json
index 523f78cde8..6a0d6973fe 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -43,6 +43,7 @@
         "moment": "^2.24.0",
         "moment-timezone": "^0.5.13",
         "ngrx-store-localstorage": "^14.0.0",
+        "ngx-clipboard": "^15.0.0",
         "ngx-moment": "^3.5.0",
         "ngx-monaco-editor": "^9.0.0",
         "normalizr": "^3.6.0",
@@ -12487,6 +12488,20 @@
         "@ngrx/store": "^14.0.0"
       }
     },
+    "node_modules/ngx-clipboard": {
+      "version": "15.1.0",
+      "resolved": "https://registry.npmjs.org/ngx-clipboard/-/ngx-clipboard-15.1.0.tgz",
+      "integrity": "sha512-dUJl1cNtdkCqL953oAhP7wmUPFrqW2aDg5OPhwPU9R3cLEdQgU2NbsHEUz4zaPyEopTXu8SR37onVm1Ep8qOHg==",
+      "license": "MIT",
+      "dependencies": {
+        "ngx-window-token": ">=6.0.0",
+        "tslib": "^2.0.0"
+      },
+      "peerDependencies": {
+        "@angular/common": ">=13.0.0",
+        "@angular/core": ">=13.0.0"
+      }
+    },
     "node_modules/ngx-moment": {
       "version": "3.5.0",
       "license": "MIT",
@@ -12512,6 +12527,22 @@
         "tslib": "^1.10.0"
       }
     },
+    "node_modules/ngx-window-token": {
+      "version": "7.0.0",
+      "resolved": "https://registry.npmjs.org/ngx-window-token/-/ngx-window-token-7.0.0.tgz",
+      "integrity": "sha512-5+XfRVSY7Dciu8xyCNMkOlH2UfwR9W2P1Pirz7caaZgOZDjFbL8aEO2stjfJJm2FFf1D6dlVHNzhLWGk9HGkqA==",
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "^2.0.0"
+      },
+      "engines": {
+        "node": "^14.20.0 || ^16.13.0 || >=18.10.0"
+      },
+      "peerDependencies": {
+        "@angular/common": ">=13.0.0",
+        "@angular/core": ">=13.0.0"
+      }
+    },
     "node_modules/nice-napi": {
       "version": "1.0.2",
       "dev": true,
diff --git a/package.json b/package.json
index 18c2b30747..18cb45117f 100644
--- a/package.json
+++ b/package.json
@@ -106,6 +106,7 @@
     "moment": "^2.24.0",
     "moment-timezone": "^0.5.13",
     "ngrx-store-localstorage": "^14.0.0",
+    "ngx-clipboard": "^15.0.0",
     "ngx-moment": "^3.5.0",
     "ngx-monaco-editor": "^9.0.0",
     "normalizr": "^3.6.0",
@@ -131,6 +132,7 @@
     "@angular-devkit/schematics": "^14.2.12",
     "@angular/cli": "^14.2.12",
     "@angular/language-service": "^14.2.12",
+    "@cypress/request": "^3.0.0",
     "@schematics/angular": "^9.1.5",
     "@types/jasmine": "~3.6.0",
     "@types/jasminewd2": "~2.0.8",
@@ -169,7 +171,6 @@
     "protractor": "^7.0.0",
     "ps-node": "^0.1.6",
     "q": "^1.4.1",
-    "@cypress/request": "^3.0.0",
     "rxjs-tslint": "^0.1.8",
     "ts-node": "^8.8.2",
     "tslint": "~6.1.0",
diff --git a/src/frontend/packages/core/src/shared/components/page-header/page-header.component.html b/src/frontend/packages/core/src/shared/components/page-header/page-header.component.html
index 955e8b3b48..bafe773795 100644
--- a/src/frontend/packages/core/src/shared/components/page-header/page-header.component.html
+++ b/src/frontend/packages/core/src/shared/components/page-header/page-header.component.html
@@ -37,6 +37,24 @@
           ">
                 |
               </span>
+              <button mat-icon-button [matMenuTriggerFor]="token">
+                <mat-icon class="page-header__credential">vpn_key</mat-icon>
+              </button>
+              <mat-menu #token="matMenu" [overlapTrigger]="false" class="page-header__menu">
+                <div class="page-header__token">
+                  <h3 class="page-header__token-title">UAA Tokens</h3>
+                  <button mat-stroked-button (click)="copy(authToken$)" matTooltip="Click to copy auth token">
+                    <span>Copy Auth Token</span>
+                    <div class="page-header__token-text" hidden>{{ authToken$ | async }}</div>
+                  </button>
+                  <button mat-stroked-button (click)="copy(refreshToken$)" matTooltip="Click to copy refresh token">
+                    <span>Copy Refresh Token</span>
+                    <div class="page-header__token-text" hidden>{{ refreshToken$ | async }}</div>
+                  </button>
+                  <h3>Token Expiry</h3>
+                  <div class="page-header__token-text">{{ tokenExpiry$ | async }}</div>
+                </div>
+              </mat-menu>
               <button *ngIf="showHistory" class="page-header__menu-button" mat-icon-button
                 [matMenuTriggerFor]="history">
                 <mat-icon class="page-header__nav-toggle">schedule</mat-icon>
diff --git a/src/frontend/packages/core/src/shared/components/page-header/page-header.component.scss b/src/frontend/packages/core/src/shared/components/page-header/page-header.component.scss
index 9d223c039b..a57d0c1444 100644
--- a/src/frontend/packages/core/src/shared/components/page-header/page-header.component.scss
+++ b/src/frontend/packages/core/src/shared/components/page-header/page-header.component.scss
@@ -64,7 +64,8 @@ $bottom-index: $top-index - 1;
     margin-right: 20px;
   }
   &__nav-toggle,
-  &__logout {
+  &__logout,
+  &__credential {
     cursor: pointer;
   }
   &__breadcrumb,
@@ -130,6 +131,21 @@ $bottom-index: $top-index - 1;
   &__favorite {
     margin-left: 10px;
   }
+  &__token {
+    min-width: 200px;
+    padding: 2px 10px 10px;
+    
+    button {
+      width: 100%;
+      margin: 2px 0 2px 0;
+    }
+  }
+  &__token-title {
+    margin: 0 0 10px;
+  }
+  &__token-text {
+    word-wrap: break-word;
+  }
 }
 
 .mat-toolbar-row,
diff --git a/src/frontend/packages/core/src/shared/components/page-header/page-header.component.spec.ts b/src/frontend/packages/core/src/shared/components/page-header/page-header.component.spec.ts
index 28296b62fc..d0473fd008 100644
--- a/src/frontend/packages/core/src/shared/components/page-header/page-header.component.spec.ts
+++ b/src/frontend/packages/core/src/shared/components/page-header/page-header.component.spec.ts
@@ -1,4 +1,5 @@
 import { ComponentFixture, TestBed, waitForAsync } from '@angular/core/testing';
+import { HttpClientTestingModule, HttpTestingController } from '@angular/common/http/testing';
 import { ActivatedRoute } from '@angular/router';
 import { RouterTestingModule } from '@angular/router/testing';
 import { StoreModule } from '@ngrx/store';
@@ -17,7 +18,16 @@ import { PageHeaderModule } from './page-header.module';
 describe('PageHeaderComponent', () => {
   let component: PageHeaderComponent;
   let fixture: ComponentFixture<PageHeaderComponent>;
+  let httpMock: HttpTestingController;
   const URL_KEY = 'key';
+  const TOKEN_RESPONSE = {
+    data: {
+      auth_token: "auth_token_mock_value",
+      refresh_token: "refresh_token_mock_value",
+      token_expiry: 1753176322,
+    }
+  };
+
   beforeEach(waitForAsync(() => {
     TestBed.configureTestingModule({
       providers: [
@@ -39,6 +49,7 @@ describe('PageHeaderComponent', () => {
         CoreModule,
         SharedModule,
         PageHeaderModule,
+        HttpClientTestingModule,
         RouterTestingModule,
         StoreModule.forRoot(
           appReducers
@@ -51,9 +62,14 @@ describe('PageHeaderComponent', () => {
   beforeEach(() => {
     fixture = TestBed.createComponent(PageHeaderComponent);
     component = fixture.componentInstance;
+    httpMock = TestBed.inject(HttpTestingController);
     fixture.detectChanges();
   });
 
+  afterEach(() => {
+    httpMock.verify();
+  });
+
   it('should be created', () => {
     expect(component).toBeTruthy();
   });
@@ -118,4 +134,43 @@ describe('PageHeaderComponent', () => {
     expect(breadcrumbDefinitions).toBeDefined();
     expect(breadcrumbDefinitions.length).toEqual(2);
   });
+
+  it('should have an auth token', (done) => {
+    component.authToken$.subscribe(data => {
+      expect(data).toEqual(TOKEN_RESPONSE.data.auth_token);
+      done();
+    });
+
+    const req = httpMock.expectOne('/api/v1/auth/token');
+    expect(req.request.method).toBe('GET');
+    req.flush(TOKEN_RESPONSE);
+
+    fixture.detectChanges();
+  })
+
+  it('should have a refresh token', (done) => {
+    component.refreshToken$.subscribe(data => {
+      expect(data).toEqual(TOKEN_RESPONSE.data.refresh_token);
+      done();
+    });
+
+    const req = httpMock.expectOne('/api/v1/auth/token');
+    expect(req.request.method).toBe('GET');
+    req.flush(TOKEN_RESPONSE);
+
+    fixture.detectChanges();
+  })
+
+  it('should have a token expiry', (done) => {
+    component.tokenExpiry$.subscribe(data => {
+      expect(data).toEqual(new Date(TOKEN_RESPONSE.data.token_expiry * 1000));
+      done();
+    });
+
+    const req = httpMock.expectOne('/api/v1/auth/token');
+    expect(req.request.method).toBe('GET');
+    req.flush(TOKEN_RESPONSE);
+
+    fixture.detectChanges();
+  })
 });
diff --git a/src/frontend/packages/core/src/shared/components/page-header/page-header.component.ts b/src/frontend/packages/core/src/shared/components/page-header/page-header.component.ts
index e1da835576..264d245a51 100644
--- a/src/frontend/packages/core/src/shared/components/page-header/page-header.component.ts
+++ b/src/frontend/packages/core/src/shared/components/page-header/page-header.component.ts
@@ -13,10 +13,12 @@ import {
   AppState,
   selectIsMobile,
   UserProfileInfo,
+  AuthTokenEnvelope,
 } from '@stratosui/store';
 import moment from 'moment';
-import { combineLatest, Observable } from 'rxjs';
-import { map, startWith } from 'rxjs/operators';
+import { combineLatest, Observable, of } from 'rxjs';
+import { map, startWith, tap } from 'rxjs/operators';
+import { ClipboardService } from 'ngx-clipboard';
 
 import { CurrentUserPermissionsService } from '../../../core/permissions/current-user-permissions.service';
 import { StratosCurrentUserPermissions } from '../../../core/permissions/stratos-user-permissions.checker';
@@ -27,6 +29,8 @@ import { GlobalEventService, IGlobalEvent } from '../../global-events.service';
 import { EndpointsService } from './../../../core/endpoints.service';
 import { environment } from './../../../environments/environment';
 import { BREADCRUMB_URL_PARAM, IHeaderBreadcrumb, IHeaderBreadcrumbLink } from './page-header.types';
+import { HttpClient } from '@angular/common/http';
+import { SnackBarService } from '../../services/snackbar.service';
 
 @Component({
   selector: 'app-page-header',
@@ -115,6 +119,9 @@ export class PageHeaderComponent implements OnDestroy, AfterViewInit {
   public user$: Observable<UserProfileInfo>;
   public allowGravatar$: Observable<boolean>;
   public canLogout$: Observable<boolean>;
+  public authToken$: Observable<string>;
+  public refreshToken$: Observable<string>;
+  public tokenExpiry$: Observable<Date>;
 
   public actionsKey: string;
 
@@ -146,6 +153,19 @@ export class PageHeaderComponent implements OnDestroy, AfterViewInit {
     this.router.navigate(['/login/logout']);
   }
 
+  getUAAToken() {
+    const url = `/api/${environment.proxyAPIVersion}/auth/token`;
+
+    return this.http
+      .get<AuthTokenEnvelope>(url)
+  }
+
+  async copy(input: Observable<string>) {
+    const copyable = await input.toPromise()
+    this.clipboardService.copy(copyable);
+    this.snackBarService.show('Successfully copied!', 'Close')
+  }
+
   public toggleSidenav() {
     this.store.dispatch(new ToggleSideNav());
   }
@@ -160,6 +180,9 @@ export class PageHeaderComponent implements OnDestroy, AfterViewInit {
     private cups: CurrentUserPermissionsService,
     private endpointsService: EndpointsService,
     private currentUserPermissionsService: CurrentUserPermissionsService,
+    private http: HttpClient,
+    private clipboardService: ClipboardService,
+    private snackBarService: SnackBarService
   ) {
     this.events$ = eventService.events$.pipe(
       startWith([])
@@ -202,6 +225,22 @@ export class PageHeaderComponent implements OnDestroy, AfterViewInit {
       map(noLogout => !noLogout)
     );
 
+    const tokenEnvelope = this.getUAAToken()
+
+    this.authToken$ = tokenEnvelope
+      .pipe(
+        map((token) => token.data.auth_token)
+      );
+
+    this.refreshToken$ = tokenEnvelope
+      .pipe(
+        map((token) => token.data.refresh_token)
+      );
+
+    this.tokenExpiry$ = tokenEnvelope
+      .pipe(
+        map((token) => new Date(token.data.token_expiry*1000))
+      );
   }
 
   ngOnDestroy() {
diff --git a/src/frontend/packages/core/src/shared/components/page-header/page-header.module.ts b/src/frontend/packages/core/src/shared/components/page-header/page-header.module.ts
index 37b1801308..fbb1d6c26b 100644
--- a/src/frontend/packages/core/src/shared/components/page-header/page-header.module.ts
+++ b/src/frontend/packages/core/src/shared/components/page-header/page-header.module.ts
@@ -1,4 +1,5 @@
 import { NgModule } from '@angular/core';
+import { HttpClientModule } from '@angular/common/http';
 
 import { CoreModule } from '../../../core/core.module';
 import { ExtensionButtonsComponent } from '../extension-buttons/extension-buttons.component';
@@ -9,6 +10,7 @@ import { ShowPageHeaderComponent } from './show-page-header/show-page-header.com
 @NgModule({
   imports: [
     CoreModule,
+    HttpClientModule,
   ],
   declarations: [
     ExtensionButtonsComponent,
diff --git a/src/frontend/packages/store/src/public-api.ts b/src/frontend/packages/store/src/public-api.ts
index c00a1f066c..3a4089eeee 100644
--- a/src/frontend/packages/store/src/public-api.ts
+++ b/src/frontend/packages/store/src/public-api.ts
@@ -8,7 +8,7 @@ export * from './helpers/store-helpers';
 // Used by store testing module
 export { getDefaultRequestState } from './reducers/api-request-reducer/types';
 export { getDefaultPaginationEntityState } from './reducers/pagination-reducer/pagination-reducer-reset-pagination';
-export { SessionDataEndpoint } from './types/auth.types';
+export { SessionDataEndpoint, AuthTokenEnvelope } from './types/auth.types';
 export { getDefaultRolesRequestState } from './types/current-user-roles.types';
 export { BaseEntityValues } from './types/entity.types';
 export { WrapperRequestActionSuccess } from './types/request.types';
diff --git a/src/frontend/packages/store/src/types/auth.types.ts b/src/frontend/packages/store/src/types/auth.types.ts
index c12d9cd835..0b137cdb79 100644
--- a/src/frontend/packages/store/src/types/auth.types.ts
+++ b/src/frontend/packages/store/src/types/auth.types.ts
@@ -72,12 +72,33 @@ export interface SessionData {
   config: SessionDataConfig;
 }
 
+export interface TokenData {
+  token_guid: string
+  auth_token: string
+  refresh_token: string
+  token_expiry: number
+  disconnected: boolean
+  auth_type: string
+  metadata: string
+  system_shared: boolean
+  linked_guid: string
+  certificate: string
+  certificate_key: string
+  enabled: boolean
+}
+
 export interface SessionDataEnvelope {
   status: string;
   error?: string;
   data?: SessionData;
 }
 
+export interface AuthTokenEnvelope {
+  status: string;
+  error?: string;
+  data?: TokenData;
+}
+
 export interface Diagnostics {
   deploymentType?: string;
   gitClientVersion?: string;
diff --git a/src/jetstream/api/structs.go b/src/jetstream/api/structs.go
index dae28bacfc..48d5805103 100644
--- a/src/jetstream/api/structs.go
+++ b/src/jetstream/api/structs.go
@@ -139,18 +139,18 @@ type BackupTokenRecord struct {
 
 // TokenRecord repsrents and endpoint or uaa token
 type TokenRecord struct {
-	TokenGUID      string
-	AuthToken      string
-	RefreshToken   string
-	TokenExpiry    int64
-	Disconnected   bool
-	AuthType       string
-	Metadata       string
-	SystemShared   bool
-	LinkedGUID     string // Indicates the GUID of the token that this token is linked to (if any)
-	Certificate    string
-	CertificateKey string
-	Enabled        bool
+	TokenGUID      string `json:"token_guid"`
+	AuthToken      string `json:"auth_token"`
+	RefreshToken   string `json:"refresh_token"`
+	TokenExpiry    int64  `json:"token_expiry"`
+	Disconnected   bool   `json:"disconnected"`
+	AuthType       string `json:"auth_type"`
+	Metadata       string `json:"metadata"`
+	SystemShared   bool   `json:"system_shared"`
+	LinkedGUID     string `json:"linked_guid"` // Indicates the GUID of the token that this token is linked to (if any)
+	Certificate    string `json:"certificate"`
+	CertificateKey string `json:"certificate_key"`
+	Enabled        bool   `json:"enabled"`
 }
 
 type CFInfo struct {
diff --git a/src/jetstream/main.go b/src/jetstream/main.go
index 624baab76c..a4867b40f1 100644
--- a/src/jetstream/main.go
+++ b/src/jetstream/main.go
@@ -911,6 +911,8 @@ func (p *portalProxy) registerRoutes(e *echo.Echo, needSetupMiddleware bool) {
 	// Verify Session
 	api.GET("/v1/auth/verify", p.verifySession)
 
+	api.GET("/v1/auth/token", p.retrieveToken)
+
 	// Always serve the backend API from /pp
 	pp := e.Group("/pp")
 
diff --git a/src/jetstream/session.go b/src/jetstream/session.go
index 1af184e295..a9131b8c1d 100644
--- a/src/jetstream/session.go
+++ b/src/jetstream/session.go
@@ -50,6 +50,12 @@ type SessionInfoEnvelope struct {
 	Data   *api.Info `json:"data"`
 }
 
+type AuthTokenEnvelope struct {
+	Status string           `json:"status"`
+	Error  string           `json:"error"`
+	Data   *api.TokenRecord `json:"data"`
+}
+
 func (e *SessionValueNotFound) Error() string {
 	return fmt.Sprintf("Session value not found %s", e.msg)
 }
@@ -318,3 +324,62 @@ func (p *portalProxy) verifySession(c echo.Context) error {
 		},
 	)
 }
+
+func (p *portalProxy) retrieveToken(c echo.Context) error {
+	log.Debug("retrieveToken")
+
+	p.StratosAuthService.BeforeVerifySession(c)
+
+	sessionExpireTime, err := p.GetSessionInt64Value(c, "exp")
+	if err != nil {
+		return c.JSON(
+			http.StatusOK,
+			AuthTokenEnvelope{
+				Status: "error",
+				Error:  err.Error(),
+			},
+		)
+	}
+
+	sessionUser, err := p.GetSessionStringValue(c, "user_id")
+	if err != nil {
+		return c.JSON(
+			http.StatusOK,
+			AuthTokenEnvelope{
+				Status: "error",
+				Error:  err.Error(),
+			},
+		)
+	}
+
+	err = p.StratosAuthService.VerifySession(c, sessionUser, sessionExpireTime)
+	if err != nil {
+		return c.JSON(
+			http.StatusOK,
+			AuthTokenEnvelope{
+				Status: "error",
+				Error:  err.Error(),
+			},
+		)
+	}
+
+	record, err := p.GetUAATokenRecord(sessionUser)
+
+	if err != nil {
+		return c.JSON(
+			http.StatusOK,
+			AuthTokenEnvelope{
+				Status: "error",
+				Error:  err.Error(),
+			},
+		)
+	}
+
+	return c.JSON(
+		http.StatusOK,
+		AuthTokenEnvelope{
+			Status: "ok",
+			Data:   &record,
+		},
+	)
+}
diff --git a/src/jetstream/session_test.go b/src/jetstream/session_test.go
index 7be6e7baf2..c2f4324d69 100644
--- a/src/jetstream/session_test.go
+++ b/src/jetstream/session_test.go
@@ -11,33 +11,101 @@ import (
 	. "github.com/smartystreets/goconvey/convey"
 )
 
+/*
+Portal Proxy mock that errors out when looking for a session
+*/
 type sessionTestPortalProxy struct {
 	portalProxy
 }
 
-type testEchoContext struct {
+func (*sessionTestPortalProxy) GetSession(_ echo.Context) (*sessions.Session, error) {
+	return nil, errors.New("Test error")
+}
+
+/*
+Echo context mock that will make everything work and bypass all session checks
+*/
+type testEchoContextBypass struct {
 	echo.Context
+	JSONResponseVerifier func(statusCode int, input any) error
 }
 
-func (s *testEchoContext) Request() *http.Request {
-	return nil
+func (*testEchoContextBypass) Request() *http.Request {
+	return &http.Request{}
 }
 
-func (s *testEchoContext) Get(key string) interface{} {
+func (*testEchoContextBypass) Get(_ string) any {
 	return nil
 }
 
-func (p *sessionTestPortalProxy) GetSession(c echo.Context) (*sessions.Session, error) {
-	return nil, errors.New("Test error")
+func (*testEchoContextBypass) Set(_ string, _ any) {}
+
+func (c *testEchoContextBypass) JSON(statusCode int, input any) error {
+	return c.JSONResponseVerifier(statusCode, input)
 }
 
-type testSessionStore struct {
+type testSessionStoreFailure struct {
 	api.SessionStorer
 }
 
-func (p *testSessionStore) Get(req *http.Request, name string) (*sessions.Session, error) {
+func (p *testSessionStoreFailure) Get(_ *http.Request, _ string) (*sessions.Session, error) {
 	return nil, errors.New("Test error")
 }
+
+type testSessionStoreSuccessful struct {
+	api.SessionStorer
+}
+
+func (p *testSessionStoreSuccessful) Get(_ *http.Request, _ string) (*sessions.Session, error) {
+	return &sessions.Session{
+		ID: "00000000-0000-0000-0000-000000000001",
+		Values: map[any]any{
+			"exp":     int64(9223372036854775807),
+			"user_id": "mockuid",
+		},
+		Options: &sessions.Options{},
+		IsNew:   false,
+	}, nil
+}
+
+type testStratosAuthService struct {
+	api.StratosAuth
+}
+
+func (s *testStratosAuthService) BeforeVerifySession(c echo.Context) {}
+func (s *testStratosAuthService) VerifySession(c echo.Context, sessionUser string, expiryTime int64) error {
+	return nil
+}
+
+type testStoreFactory struct {
+	api.StoreFactory
+}
+
+func (s *testStoreFactory) TokenStore() (api.TokenRepository, error) {
+	return &testTokenStore{}, nil
+}
+
+type testTokenStore struct {
+	api.TokenRepository
+}
+
+func (s *testTokenStore) FindAuthToken(userGUID string, encryptionKey []byte) (api.TokenRecord, error) {
+	return api.TokenRecord{
+		TokenGUID:      "mockTokenGUID",
+		AuthToken:      "mockAuthToken",
+		RefreshToken:   "mockRefreshToken",
+		TokenExpiry:    1,
+		Disconnected:   false,
+		AuthType:       "mockAuthType",
+		Metadata:       "mockMetadata",
+		SystemShared:   false,
+		LinkedGUID:     "mockLinkedGUID",
+		Certificate:    "mockCertificate",
+		CertificateKey: "mockCertificateKey",
+		Enabled:        false,
+	}, nil
+}
+
 func TestSession(t *testing.T) {
 
 	Convey("Check error struct", t, func() {
@@ -52,10 +120,10 @@ func TestSession(t *testing.T) {
 	Convey("Check error conditions when no session avaialable", t, func() {
 
 		pp := &portalProxy{
-			SessionStore: &testSessionStore{},
+			SessionStore: &testSessionStoreFailure{},
 		}
 
-		ctx := &testEchoContext{}
+		ctx := &testEchoContextBypass{}
 
 		_, err := pp.GetSession(ctx)
 		So(err, ShouldNotBeNil)
@@ -74,4 +142,51 @@ func TestSession(t *testing.T) {
 		So(err, ShouldNotBeNil)
 	})
 
+	Convey("Return the token on request for the current session when session is valid", t, func() {
+		pp := &portalProxy{
+			SessionStore:       &testSessionStoreSuccessful{},
+			StratosAuthService: &testStratosAuthService{},
+			StoreFactory:       &testStoreFactory{},
+		}
+
+		ctx := &testEchoContextBypass{JSONResponseVerifier: func(s int, i any) error {
+			So(s, ShouldEqual, http.StatusOK)
+			t, ok := i.(AuthTokenEnvelope)
+			So(ok, ShouldBeTrue)
+			So(t.Error, ShouldBeEmpty)
+			So(t.Status, ShouldEqual, "ok")
+			So(t.Data.AuthToken, ShouldEqual, "mockAuthToken")
+			So(t.Data.RefreshToken, ShouldEqual, "mockRefreshToken")
+			So(t.Data.TokenExpiry, ShouldEqual, 1)
+
+			return nil
+		}}
+
+		err := pp.retrieveToken(ctx)
+
+		So(err, ShouldBeNil)
+	})
+
+	Convey("Return error message and no token on request if current session is invalid", t, func() {
+		pp := &portalProxy{
+			SessionStore:       &testSessionStoreFailure{},
+			StratosAuthService: &testStratosAuthService{},
+			StoreFactory:       &testStoreFactory{},
+		}
+
+		ctx := &testEchoContextBypass{JSONResponseVerifier: func(s int, i any) error {
+			So(s, ShouldEqual, http.StatusOK)
+			t, ok := i.(AuthTokenEnvelope)
+			So(ok, ShouldBeTrue)
+			So(t.Error, ShouldNotBeBlank)
+			So(t.Status, ShouldEqual, "error")
+			So(t.Data, ShouldBeNil)
+			return nil
+		}}
+
+		err := pp.retrieveToken(ctx)
+
+		So(err, ShouldBeNil)
+	})
+
 }