diff --git a/internal/api/router.go b/internal/api/router.go
index fae383aa1..5c28d5542 100644
--- a/internal/api/router.go
+++ b/internal/api/router.go
@@ -352,7 +352,7 @@ echo "You will need to log in with your saved credentials."
 				
 			} else if isDocker {
 				// For Docker, save credentials to persistent storage
-				// Docker containers need to persist auth config to /etc/pulse
+				// Docker containers need to persist auth config to /data
 				envPath := filepath.Join(r.config.ConfigPath, ".env")
 				envContent := fmt.Sprintf(`# Auto-generated by Pulse Quick Security Setup
 # Generated on %s
@@ -552,7 +552,14 @@ ENABLE_AUDIT_LOG=true
 			hasValidAPIToken := false
 			if r.config.APIToken != "" {
 				authHeader := req.Header.Get("X-API-Token")
-				hasValidAPIToken = (authHeader == r.config.APIToken)
+				// Check if stored token is hashed or plain text
+				if internalauth.IsAPITokenHashed(r.config.APIToken) {
+					// Compare against hash
+					hasValidAPIToken = internalauth.CompareAPIToken(authHeader, r.config.APIToken)
+				} else {
+					// Plain text comparison (legacy)
+					hasValidAPIToken = (authHeader == r.config.APIToken)
+				}
 			}
 			
 			// If password auth is configured, session auth is sufficient
@@ -625,7 +632,14 @@ ENABLE_AUDIT_LOG=true
 			hasValidAPIToken := false
 			if r.config.APIToken != "" {
 				authHeader := req.Header.Get("X-API-Token")
-				hasValidAPIToken = (authHeader == r.config.APIToken)
+				// Check if stored token is hashed or plain text
+				if internalauth.IsAPITokenHashed(r.config.APIToken) {
+					// Compare against hash
+					hasValidAPIToken = internalauth.CompareAPIToken(authHeader, r.config.APIToken)
+				} else {
+					// Plain text comparison (legacy)
+					hasValidAPIToken = (authHeader == r.config.APIToken)
+				}
 			}
 			
 			// If password auth is configured, session auth is sufficient