diff --git a/Composer/packages/client/src/recoilModel/dispatchers/publisher.ts b/Composer/packages/client/src/recoilModel/dispatchers/publisher.ts
index 029f7be2cb..fb83da97f7 100644
--- a/Composer/packages/client/src/recoilModel/dispatchers/publisher.ts
+++ b/Composer/packages/client/src/recoilModel/dispatchers/publisher.ts
@@ -180,20 +180,15 @@ export const publisherDispatcher = () => {
         const luFiles = await snapshot.getPromise(luFilesState(projectId));
         const qnaFiles = await snapshot.getPromise(qnaFilesState(projectId));
         const referredLuFiles = luUtil.checkLuisBuild(luFiles, dialogs);
-        const response = await httpClient.post(
-          `/publish/${projectId}/publish/${target.name}`,
-          {
-            metadata: {
-              ...metadata,
-              luResources: referredLuFiles.map((file) => ({ id: file.id, isEmpty: file.empty })),
-              qnaResources: qnaFiles.map((file) => ({ id: file.id, isEmpty: file.empty })),
-            },
-            sensitiveSettings,
+        const response = await httpClient.post(`/publish/${projectId}/publish/${target.name}`, {
+          accessToken: token,
+          metadata: {
+            ...metadata,
+            luResources: referredLuFiles.map((file) => ({ id: file.id, isEmpty: file.empty })),
+            qnaResources: qnaFiles.map((file) => ({ id: file.id, isEmpty: file.empty })),
           },
-          {
-            headers: { Authorization: `Bearer ${token}` },
-          }
-        );
+          sensitiveSettings,
+        });
         await publishSuccess(callbackHelpers, projectId, response.data, target);
       } catch (err) {
         // special case to handle dotnet issues
diff --git a/Composer/packages/server/src/controllers/publisher.ts b/Composer/packages/server/src/controllers/publisher.ts
index b4ae0a022b..ecf6d1bbd3 100644
--- a/Composer/packages/server/src/controllers/publisher.ts
+++ b/Composer/packages/server/src/controllers/publisher.ts
@@ -53,7 +53,7 @@ export const PublishController = {
   publish: async (req, res) => {
     const target: string = req.params.target;
     const user = await ExtensionContext.getUserFromRequest(req);
-    const { metadata, sensitiveSettings } = req.body;
+    const { accessToken = '', metadata, sensitiveSettings } = req.body;
     const projectId: string = req.params.projectId;
     const currentProject = await BotProjectService.getProjectById(projectId, user);
 
@@ -68,9 +68,7 @@ export const PublishController = {
     const profile = profiles.length ? profiles[0] : undefined;
     const extensionName = profile ? profile.type : ''; // get the publish plugin key
 
-    // get token from header
-    const accessToken = req.headers.authorization?.substring('Bearer '.length);
-    log('access token get from header: %s', accessToken);
+    log('access token retrieved from body: %s', accessToken || 'no token provided');
     if (profile && extensionImplementsMethod(extensionName, 'publish')) {
       // append config from client(like sensitive settings)
       const configuration = {