diff --git a/tests/Controller/ProfileControllerTest.php b/tests/Controller/ProfileControllerTest.php
index 56528a0c..718e53b4 100644
--- a/tests/Controller/ProfileControllerTest.php
+++ b/tests/Controller/ProfileControllerTest.php
@@ -12,6 +12,7 @@ namespace App\Tests\Controller;
 use App\DataFixtures\UserFixtures;
 use App\Entity\User;
 use App\Entity\UserPreference;
+use App\Repository\AccessTokenRepository;
 use App\Tests\DataFixtures\TeamFixtures;
 use App\Tests\DataFixtures\TimesheetFixtures;
 use App\WorkingTime\Mode\WorkingTimeModeDay;
@@ -243,15 +244,55 @@ class ProfileControllerTest extends AbstractControllerBaseTestCase
         );
     }
 
+    public function testCreateApiToken(): void
+    {
+        $client = $this->getClientForAuthenticatedUser(User::ROLE_USER);
+
+        $user = $this->getUserByRole(User::ROLE_USER);
+
+        /** @var AccessTokenRepository $tokenRepository */
+        $tokenRepository = self::getContainer()->get(AccessTokenRepository::class);
+        $tokens = $tokenRepository->findForUser($user);
+        self::assertCount(1, $tokens);
+
+        $this->request($client, '/profile/' . UserFixtures::USERNAME_USER . '/create-access-token');
+
+        $form = $client->getCrawler()->filter('form[name=access_token_form]')->form();
+        $client->submit($form, [
+            'access_token_form' => [
+                'name' => 'Demo',
+                'expiresAt' => ''
+            ]
+        ]);
+
+        // if you follow this redirect, the info will not be shown
+        $this->assertIsRedirect($client, $this->createUrl('/profile/' . urlencode(UserFixtures::USERNAME_USER) . '/api-token?hide-token=1'));
+
+        $this->request($client, '/profile/' . UserFixtures::USERNAME_USER . '/api-token');
+        self::assertTrue($client->getResponse()->isSuccessful());
+
+        $crawler = $client->getCrawler();
+        $block = $crawler->filter('div.codeblock');
+        self::assertEquals(1, $block->count());
+        $copy = $crawler->filter('div.codeblock-copy');
+        self::assertEquals(1, $copy->count());
+        $code = $block->filter('pre code');
+        self::assertEquals(1, $code->count());
+
+        $tokens = $tokenRepository->findForUser($user);
+        self::assertCount(2, $tokens);
+        self::assertEquals('Demo', $tokens[1]->getName());
+        self::assertEquals($code->innerText(), $tokens[1]->getToken());
+    }
+
     /**
      * @group legacy
      */
-    public function testApiTokenAction(): void
+    public function testCreateApiPassword(): void
     {
         $client = $this->getClientForAuthenticatedUser(User::ROLE_USER);
         $this->request($client, '/profile/' . UserFixtures::USERNAME_USER . '/api-token');
 
-        /** @var User $user */
         $user = $this->getUserByRole(User::ROLE_USER);
         /** @var PasswordHasherFactoryInterface $passwordEncoder */
         $passwordEncoder = self::getContainer()->get('security.password_hasher_factory');
@@ -282,7 +323,10 @@ class ProfileControllerTest extends AbstractControllerBaseTestCase
         self::assertTrue($passwordEncoder->getPasswordHasher($user)->verify($user->getApiToken(), 'test1234'));
     }
 
-    public function testApiTokenActionFailsIfPasswordLengthToShort(): void
+    /**
+     * @group legacy
+     */
+    public function testCreateApiPasswordFailsIfPasswordLengthToShort(): void
     {
         $this->assertFormHasValidationError(
             User::ROLE_USER,