diff --git a/data.go b/data.go
index c532bf1..2531c8d 100644
--- a/data.go
+++ b/data.go
@@ -251,8 +251,8 @@
 		} else {
 			// first start - no row, generate a UUID and store it
 			err = nil
+			newInstanceID = true
 			info.InstanceID = generateUUID()
-			updateApidInstanceInfo()
 
 			db.Exec("INSERT INTO APID (instance_id) VALUES (?)", info.InstanceID)
 		}
diff --git a/init.go b/init.go
index 8ecc940..d16b24a 100644
--- a/init.go
+++ b/init.go
@@ -78,8 +78,6 @@
 	data = services.Data()
 	events = services.Events()
 
-	tokenManager = createTokenManager()
-
 	/* This callback function will get called, once all the plugins are
 	 * initialized (not just this plugin). This is needed because,
 	 * downloadSnapshots/changes etc have to begin to be processed only
@@ -120,6 +118,8 @@
 	}
 	config.Set(configApidInstanceID, apidInfo.InstanceID)
 
+	tokenManager = createTokenManager()
+
 	log.Debug("end init")
 
 	return pluginData, nil
diff --git a/token.go b/token.go
index cca8963..4561812 100644
--- a/token.go
+++ b/token.go
@@ -151,7 +151,7 @@
 		var token oauthToken
 		err = json.Unmarshal(body, &token)
 		if err != nil {
-			log.Error("unable to unmarshal JSON response %s: %v", string(body), err)
+			log.Errorf("unable to unmarshal JSON response '%s': %v", string(body), err)
 			continue
 		}
 
@@ -164,6 +164,11 @@
 
 		log.Debugf("Got new token: %#v", token)
 
+		if newInstanceID {
+			newInstanceID = false
+			updateApidInstanceInfo()
+		}
+
 		t.token = &token
 		config.Set(configBearerToken, token.AccessToken)
 		return
diff --git a/token_test.go b/token_test.go
index 24bd13a..5deec1c 100644
--- a/token_test.go
+++ b/token_test.go
@@ -91,7 +91,6 @@
 				defer GinkgoRecover()
 
 				count++
-
 				if count > 1 {
 					if start.Add(500).After(time.Now()) {
 						Fail("didn't refresh within expected interval")
@@ -109,6 +108,7 @@
 			}))
 			defer ts.Close()
 
+			tokenManager.getToken()
 			tokenManager.close()
 			oldBase := config.Get(configProxyServerBaseURI)
 			config.Set(configProxyServerBaseURI, ts.URL)
@@ -125,5 +125,51 @@
 			<-finished
 			close(done)
 		})
+
+		It("should have created_at_apid first time, update_at_apid after", func(done Done) {
+
+			finished := make(chan bool)
+			var tm *tokenMan
+			count := 0
+			ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				defer GinkgoRecover()
+
+				count++
+				if count == 1 {
+					Expect(newInstanceID).To(BeTrue())
+					Expect(r.Header.Get("created_at_apid")).NotTo(BeEmpty())
+					Expect(r.Header.Get("updated_at_apid")).To(BeEmpty())
+				} else {
+					Expect(newInstanceID).To(BeFalse())
+					Expect(r.Header.Get("created_at_apid")).To(BeEmpty())
+					Expect(r.Header.Get("updated_at_apid")).NotTo(BeEmpty())
+					finished <- true
+				}
+				res := oauthToken{
+					AccessToken: string(count),
+					ExpiresIn:   2000,
+				}
+				body, err := json.Marshal(res)
+				Expect(err).NotTo(HaveOccurred())
+				w.Write(body)
+			}))
+			defer ts.Close()
+
+			tokenManager.getToken()
+			tokenManager.close()
+			oldBase := config.Get(configProxyServerBaseURI)
+			config.Set(configProxyServerBaseURI, ts.URL)
+			defer func() {
+				tm.close()
+				config.Set(configProxyServerBaseURI, oldBase)
+				tokenManager = createTokenManager()
+			}()
+
+			newInstanceID = true
+			tm = createTokenManager()
+			tm.invalidateToken()
+			<-finished
+			close(done)
+		})
 	})
 })