diff --git a/contrib/endpoints/src/api_manager/auth/service_account_token.cc b/contrib/endpoints/src/api_manager/auth/service_account_token.cc
index a0ff6d4cc8..f9dc95b002 100644
--- a/contrib/endpoints/src/api_manager/auth/service_account_token.cc
+++ b/contrib/endpoints/src/api_manager/auth/service_account_token.cc
@@ -37,8 +37,12 @@ const int kClientSecretAuthTokenExpiration(3600 - 100);
 }  // namespace
 
 Status ServiceAccountToken::SetClientAuthSecret(const std::string& secret) {
-  client_auth_secret_ = secret;
+  if (secret.empty()) {
+    env_->LogDebug("SetClientAuthSecret called with empty secret");
+    return Status::OK;
+  }
 
+  client_auth_secret_ = secret;
   for (unsigned int i = 0; i < JWT_TOKEN_TYPE_MAX; i++) {
     if (!jwt_tokens_[i].audience().empty()) {
       Status status = jwt_tokens_[i].GenerateJwtToken(client_auth_secret_);