diff --git a/src/API/UserController.php b/src/API/UserController.php
index a0aa391f..943585c5 100644
--- a/src/API/UserController.php
+++ b/src/API/UserController.php
@@ -226,11 +226,17 @@ final class UserController extends BaseApiController
             $password = $this->encoder->encodePassword($user, $user->getPlainPassword());
             $user->setPassword($password);
 
+            if ($user->getPlainApiToken() !== null) {
+                $user->setApiToken($this->encoder->encodePassword($user, $user->getPlainApiToken()));
+            }
+
             $this->repository->saveUser($user);
 
             $view = new View($user, 200);
             $view->getContext()->setGroups(self::GROUPS_ENTITY);
 
+            $user->eraseCredentials();
+
             return $this->viewHandler->handle($view);
         }
 
diff --git a/src/Entity/User.php b/src/Entity/User.php
index e6554915..67b91c0c 100644
--- a/src/Entity/User.php
+++ b/src/Entity/User.php
@@ -156,8 +156,9 @@ class User implements UserInterface, EquatableInterface, \Serializable
      */
     private $apiToken;
     /**
-     * @var string
+     * @var string|null
      * @internal to be set via form, must not be persisted
+     *
      * @Assert\NotBlank(groups={"ApiTokenUpdate"})
      * @Assert\Length(min="8", max="60", groups={"ApiTokenUpdate"})
      */
@@ -848,6 +849,7 @@ class User implements UserInterface, EquatableInterface, \Serializable
     public function eraseCredentials()
     {
         $this->plainPassword = null;
+        $this->plainApiToken = null;
     }
 
     /**
diff --git a/src/Form/API/UserApiCreateForm.php b/src/Form/API/UserApiCreateForm.php
index 50e1f4f6..1c255d0f 100644
--- a/src/Form/API/UserApiCreateForm.php
+++ b/src/Form/API/UserApiCreateForm.php
@@ -24,7 +24,9 @@ class UserApiCreateForm extends UserCreateType
     {
         parent::buildForm($builder, $options);
 
-        $builder->remove('plainPassword');
+        if ($builder->has('plainPassword')) {
+            $builder->remove('plainPassword');
+        }
 
         $builder->add('plainPassword', PasswordType::class, [
             'required' => true,
@@ -35,6 +37,19 @@ class UserApiCreateForm extends UserCreateType
             ],
         ]);
 
+        if ($builder->has('plainApiToken')) {
+            $builder->remove('plainApiToken');
+        }
+
+        $builder->add('plainApiToken', PasswordType::class, [
+            'required' => false,
+            'label' => 'label.api_token',
+            'documentation' => [
+                'type' => 'string',
+                'description' => 'Plain API token',
+            ],
+        ]);
+
         if ($options['include_roles']) {
             $builder->add('roles', UserRoleType::class, [
                 'label' => 'label.roles',