diff --git a/registry/client/auth/session.go b/registry/client/auth/session.go
index aad8a0e6f..5d2322f35 100644
--- a/registry/client/auth/session.go
+++ b/registry/client/auth/session.go
@@ -366,6 +366,10 @@ func (th *tokenHandler) fetchTokenWithOAuth(realm *url.URL, refreshToken, servic
 		return "", time.Time{}, fmt.Errorf("unable to decode token response: %s", err)
 	}
 
+	if tr.AccessToken == "" {
+		return "", time.Time{}, ErrNoToken
+	}
+
 	if tr.RefreshToken != "" && tr.RefreshToken != refreshToken {
 		th.creds.SetRefreshToken(realm, service, tr.RefreshToken)
 	}