diff --git a/hassio/api/security.py b/hassio/api/security.py
index 69888786b..2ecb67daa 100644
--- a/hassio/api/security.py
+++ b/hassio/api/security.py
@@ -35,11 +35,6 @@ class SecurityMiddleware(CoreSysAttributes):
                 _LOGGER.debug("Passthrough %s", request.path)
                 return await handler(request)
 
-        # Unknown API access
-        if not hassio_token:
-            _LOGGER.warning("Invalid token for access %s", request.path)
-            raise HTTPUnauthorized()
-
         # Home-Assistant
         if hassio_token == self.sys_homeassistant.uuid:
             _LOGGER.debug("%s access from Home-Assistant", request.path)
@@ -51,11 +46,14 @@ class SecurityMiddleware(CoreSysAttributes):
             request[REQUEST_FROM] = 'host'
 
         # Add-on
-        addon = self.sys_addons.from_uuid(hassio_token)
+        addon = self.sys_addons.from_uuid(hassio_token) \
+            if hassio_token else None
         if addon:
             _LOGGER.info("%s access from %s", request.path, addon.slug)
             request[REQUEST_FROM] = addon.slug
 
-        if not request.get(REQUEST_FROM):
-            raise HTTPUnauthorized()
-        return await handler(request)
+        if request.get(REQUEST_FROM):
+            return await handler(request)
+
+        _LOGGER.warning("Invalid token for access %s", request.path)
+        raise HTTPUnauthorized()
diff --git a/hassio/bootstrap.py b/hassio/bootstrap.py
index 4bc718aea..1d661f752 100644
--- a/hassio/bootstrap.py
+++ b/hassio/bootstrap.py
@@ -28,7 +28,8 @@ _LOGGER = logging.getLogger(__name__)
 ENV_SHARE = 'SUPERVISOR_SHARE'
 ENV_NAME = 'SUPERVISOR_NAME'
 ENV_REPO = 'HOMEASSISTANT_REPOSITORY'
-ENV_MACHINE = 'MACHINE_ID'
+
+MACHINE_ID = Path('/etc/machine-id')
 
 
 def initialize_coresys(loop):
@@ -54,7 +55,8 @@ def initialize_coresys(loop):
     initialize_system_data(coresys)
 
     # Set Machine/Host ID
-    coresys.machine_id = os.environ.get(ENV_MACHINE)
+    if MACHINE_ID.exists():
+        coresys.machine_id = MACHINE_ID.read_text().strip()
 
     return coresys