diff --git a/.github/workflows/builds.yml b/.github/workflows/builds.yml
index 3d48f16..9532af8 100644
--- a/.github/workflows/builds.yml
+++ b/.github/workflows/builds.yml
@@ -1,4 +1,4 @@
-name: Builds and lints
+name: Builds
 
 on:
   pull_request:
@@ -10,20 +10,9 @@ on:
   workflow_dispatch:
 
 jobs:
-  lint:
-    name: Lint
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@v2
-      - name: golangci-lint
-        uses: golangci/golangci-lint-action@v2
-        with:
-          version: latest
-
   build_cli:
     name: Build CLI
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-20.04
 
     steps:
       - uses: actions/checkout@v2
@@ -56,7 +45,7 @@ jobs:
   build_image:
     needs: build_cli
     name: Build Docker image
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-20.04
 
     steps:
       - uses: actions/checkout@v2
diff --git a/.github/workflows/publish_to_dockerhub.yml b/.github/workflows/publish_to_dockerhub.yml
index 9e9d591..bdf8e26 100644
--- a/.github/workflows/publish_to_dockerhub.yml
+++ b/.github/workflows/publish_to_dockerhub.yml
@@ -27,7 +27,7 @@ on:
 jobs:
   publish:
     name: Publish image to DockerHub
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-20.04
     steps:
       - name: Checkout (manual run)
         if: ${{ github.event_name == 'workflow_dispatch' }}
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
new file mode 100644
index 0000000..09356a2
--- /dev/null
+++ b/.github/workflows/tests.yml
@@ -0,0 +1,86 @@
+name: Tests
+
+on:
+  pull_request:
+    branches:
+      - master
+    types: [opened, synchronize]
+    paths-ignore:
+      - '**/*.md'
+  workflow_dispatch:
+
+jobs:
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v2
+      - name: golangci-lint
+        uses: golangci/golangci-lint-action@v2
+        with:
+          version: latest
+
+  cover:
+    name: Coverage
+    runs-on: ubuntu-20.04
+
+    env:
+      CGO_ENABLED: 0
+    steps:
+      - uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+
+      - name: Set up Go
+        uses: actions/setup-go@v2
+        with:
+          go-version: 1.16
+
+      - name: Restore Go modules from cache
+        uses: actions/cache@v2
+        with:
+          path: /home/runner/go/pkg/mod
+          key: deps-${{ hashFiles('go.sum') }}
+
+      - name: Update Go modules
+        run: make dep
+
+      - name: Test and write coverage profile
+        run: make cover
+
+      - name: Upload coverage results to Codecov
+        uses: codecov/codecov-action@v1
+        with:
+          fail_ci_if_error: false
+          path_to_write_report: ./coverage.txt
+          verbose: true
+
+  tests:
+    name: Tests
+    runs-on: ubuntu-20.04
+    strategy:
+      matrix:
+        go_versions: [ '1.16' ]
+      fail-fast: false
+    steps:
+      - uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+
+      - name: Set up Go
+        uses: actions/setup-go@v2
+        with:
+          go-version: '${{ matrix.go_versions }}'
+
+      - name: Restore Go modules from cache
+        uses: actions/cache@v2
+        with:
+          path: /home/runner/go/pkg/mod
+          key: deps-${{ hashFiles('go.sum') }}
+
+      - name: Update Go modules
+        run: make dep
+
+      - name: Run tests
+        run: make test
diff --git a/.gitignore b/.gitignore
index 43e1681..2726d2d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -13,3 +13,6 @@ testfile
 .neofs-cli.yml
 
 .cache
+
+coverage.txt
+coverage.html
diff --git a/Makefile b/Makefile
index 93a120d..bcee601 100644
--- a/Makefile
+++ b/Makefile
@@ -13,7 +13,7 @@ BINDIR = bin
 DIRS = $(BINDIR)
 BINS = "$(BINDIR)/neofs-http-gw"
 
-.PHONY: help all dep clean fmts fmt imports test lint docker/lint
+.PHONY: help all dep clean fmts fmt imports test cover lint docker/lint
 
 # Make all binaries
 all: $(BINS)
@@ -43,6 +43,15 @@ dep:
 	GO111MODULE=on \
 	go mod tidy -v && echo OK
 
+# Run tests
+test:
+	@go test ./... -cover
+
+# Run tests with race detection and produce coverage output
+cover:
+	@go test -v -race ./... -coverprofile=coverage.txt -covermode=atomic
+	@go tool cover -html=coverage.txt -o coverage.html
+
 # Run all code formatters
 fmts: fmt imports
 
diff --git a/tokens/bearer-token_test.go b/tokens/bearer-token_test.go
index c6ee703..f038014 100644
--- a/tokens/bearer-token_test.go
+++ b/tokens/bearer-token_test.go
@@ -82,17 +82,17 @@ func Test_fetchBearerToken(t *testing.T) {
 	}{
 		{name: "empty"},
 
-		{name: "bad base64 header", header: "WRONG BASE64", error: "could not fetch marshaled from base64"},
-		{name: "bad base64 cookie", cookie: "WRONG BASE64", error: "could not fetch marshaled from base64"},
+		{name: "bad base64 header", header: "WRONG BASE64", error: "can't base64-decode bearer token"},
+		{name: "bad base64 cookie", cookie: "WRONG BASE64", error: "can't base64-decode bearer token"},
 
-		{name: "header token unmarshal error", header: "dGVzdAo=", error: "could not unmarshal bearer token"},
-		{name: "cookie token unmarshal error", cookie: "dGVzdAo=", error: "could not unmarshal bearer token"},
+		{name: "header token unmarshal error", header: "dGVzdAo=", error: "can't unmarshal bearer token"},
+		{name: "cookie token unmarshal error", cookie: "dGVzdAo=", error: "can't unmarshal bearer token"},
 
 		{
 			name:   "bad header and cookie",
 			header: "WRONG BASE64",
 			cookie: "dGVzdAo=",
-			error:  "could not unmarshal bearer token",
+			error:  "can't unmarshal bearer token",
 		},
 
 		{