diff --git a/CHANGELOG.md b/CHANGELOG.md
index eabeb8061..78a403449 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -13,6 +13,7 @@ This project follows [Semantic Versioning](http://semver.org) guidelines.
 * Fixes missing validation of Egg Author email addresses during the setup process that could cause unexpected failures later on.
 * Fixes font rendering issues of the console on Firefox due to an outdated version of xterm.js being used.
 * Fixes display overlap issues of the two-factor configuration form in a user's settings.
+* **[security]** When authenticating using an API key a user session is now only persisted for the duration of the request before being destroyed.
 
 ### Changed
 * CPU graph changed to show the maximum amount of CPU available to a server to better match how the memory graph is displayed.
diff --git a/app/Http/Middleware/Api/AuthenticateKey.php b/app/Http/Middleware/Api/AuthenticateKey.php
index eb25dac6f..857bfab29 100644
--- a/app/Http/Middleware/Api/AuthenticateKey.php
+++ b/app/Http/Middleware/Api/AuthenticateKey.php
@@ -70,7 +70,7 @@ class AuthenticateKey
         } else {
             $model = $this->authenticateApiKey($request->bearerToken(), $keyType);
 
-            $this->auth->guard()->loginUsingId($model->user_id);
+            $this->auth->guard()->onceUsingId($model->user_id);
         }
 
         $request->attributes->set('api_key', $model);