diff --git a/pkg/cloudcommon/policy/policy.go b/pkg/cloudcommon/policy/policy.go
index 14dd40a73d..ef6fd2d197 100644
--- a/pkg/cloudcommon/policy/policy.go
+++ b/pkg/cloudcommon/policy/policy.go
@@ -134,6 +134,9 @@ func getMaskedLoginIp(userCred mcclient.TokenCredential) string {
 }
 
 func policyKey(userCred mcclient.TokenCredential) string {
+	if userCred == nil || auth.IsGuestToken(userCred) {
+		return auth.GUEST_TOKEN
+	}
 	keys := []string{userCred.GetProjectId()}
 	roles := userCred.GetRoleIds()
 	if len(roles) > 0 {
diff --git a/pkg/mcclient/auth/middleware.go b/pkg/mcclient/auth/middleware.go
index e51e8fd092..dccbe9b82c 100644
--- a/pkg/mcclient/auth/middleware.go
+++ b/pkg/mcclient/auth/middleware.go
@@ -69,6 +69,7 @@ func AuthenticateWithDelayDecision(f appsrv.FilterHandler, delayDecision bool) a
 					httperrors.UnauthorizedError(ctx, w, "InvalidToken")
 					return
 				}
+				token = &GuestToken
 			}
 		}
 		ctx = context.WithValue(ctx, appctx.APP_CONTEXT_KEY_AUTH_TOKEN, token)