diff --git a/CHANGELOG b/CHANGELOG
index be5da8bebf..b1a7c3effb 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -16,6 +16,7 @@ v 6.9.0
   - Two Step MR creation process
   - Remove unwanted files from satellite working directory with git clean -fdx
   - Accept merge request via API (sponsored by O'Reilly Media)
+  - Add more access checks during API calls
 
 v 6.8.0
   - Ability to at mention users that are participating in issue and merge req. discussion
diff --git a/lib/api/helpers.rb b/lib/api/helpers.rb
index 7ee4b9d138..654c1f62c6 100644
--- a/lib/api/helpers.rb
+++ b/lib/api/helpers.rb
@@ -8,6 +8,11 @@ module API
     def current_user
       private_token = (params[PRIVATE_TOKEN_PARAM] || env[PRIVATE_TOKEN_HEADER]).to_s
       @current_user ||= User.find_by(authentication_token: private_token)
+
+      unless @current_user && Gitlab::UserAccess.allowed?(@current_user)
+        return nil
+      end
+
       identifier = sudo_identifier()
 
       # If the sudo is the current user do nothing
diff --git a/lib/gitlab/git_access.rb b/lib/gitlab/git_access.rb
index f3e781ac4e..4f49ca4189 100644
--- a/lib/gitlab/git_access.rb
+++ b/lib/gitlab/git_access.rb
@@ -61,18 +61,7 @@ module Gitlab
     private
 
     def user_allowed?(user)
-      return false if user.blocked?
-
-      if Gitlab.config.ldap.enabled
-        if user.ldap_user?
-          # Check if LDAP user exists and match LDAP user_filter
-          Gitlab::LDAP::Access.open do |adapter|
-            return false unless adapter.allowed?(user)
-          end
-        end
-      end
-
-      true
+      Gitlab::UserAccess.allowed?(user)
     end
   end
 end
diff --git a/lib/gitlab/user_access.rb b/lib/gitlab/user_access.rb
new file mode 100644
index 0000000000..16df21b49b
--- /dev/null
+++ b/lib/gitlab/user_access.rb
@@ -0,0 +1,18 @@
+module Gitlab
+  module UserAccess
+    def self.allowed?(user)
+      return false if user.blocked?
+
+      if Gitlab.config.ldap.enabled
+        if user.ldap_user?
+          # Check if LDAP user exists and match LDAP user_filter
+          Gitlab::LDAP::Access.open do |adapter|
+            return false unless adapter.allowed?(user)
+          end
+        end
+      end
+
+      true
+    end
+  end
+end
diff --git a/spec/requests/api/api_helpers_spec.rb b/spec/requests/api/api_helpers_spec.rb
index 6f961d321b..e2f222c0d3 100644
--- a/spec/requests/api/api_helpers_spec.rb
+++ b/spec/requests/api/api_helpers_spec.rb
@@ -39,6 +39,17 @@ describe API, api: true do
   end
 
   describe ".current_user" do
+    it "should return nil for an invalid token" do
+      env[API::APIHelpers::PRIVATE_TOKEN_HEADER] = 'invalid token'
+      current_user.should be_nil
+    end
+
+    it "should return nil for a user without access" do
+      env[API::APIHelpers::PRIVATE_TOKEN_HEADER] = user.private_token
+      Gitlab::UserAccess.stub(allowed?: false)
+      current_user.should be_nil
+    end
+
     it "should leave user as is when sudo not specified" do
       env[API::APIHelpers::PRIVATE_TOKEN_HEADER] = user.private_token
       current_user.should == user