diff --git a/api.go b/api.go
index f09d8cc..281a039 100644
--- a/api.go
+++ b/api.go
@@ -89,6 +89,24 @@
 		return errorResponse(reason, errorCode)
 	}
 
+	var env, tenantId string
+	{
+		err := db.QueryRow("SELECT env, scope FROM DATA_SCOPE WHERE id = ?;", scopeuuid).Scan(&env, &tenantId)
+
+		switch {
+		case err == sql.ErrNoRows:
+			reason := "ENV Validation Failed"
+			errorCode := "ENV_VALIDATION_FAILED"
+			return errorResponse(reason, errorCode)
+		case err != nil:
+			reason := err.Error()
+			errorCode := "SEARCH_INTERNAL_ERROR"
+			return errorResponse(reason, errorCode)
+		}
+	}
+
+	log.Debug("Found tenant_id='", tenantId, "' with env='", env, "' for scopeuuid='", scopeuuid,"'")
+
 	sSql := "SELECT ap.api_resources, ap.environments, c.issued_at, c.status, a.callback_url, d.username, d.id " +
 		"FROM APP_CREDENTIAL AS c INNER JOIN APP AS a ON c.app_id = a.id " +
 		"INNER JOIN DEVELOPER AS d ON a.developer_id = d.id " +
@@ -96,11 +114,11 @@
 		"INNER JOIN API_PRODUCT as ap ON ap.id = mp.apiprdt_id " +
 		"WHERE (UPPER(d.status) = 'ACTIVE' AND mp.apiprdt_id = ap.id AND mp.app_id = a.id " +
 		"AND mp.appcred_id = c.id AND UPPER(mp.status) = 'APPROVED' AND UPPER(a.status) = 'APPROVED' " +
-		"AND c.id = '" + key + "');"
+		"AND c.id = $1 AND c.tenant_id = $2);"
 
 	var status, redirectionURIs, developerAppName, developerId, resName, resEnv string
 	var issuedAt int64
-	err := db.QueryRow(sSql).Scan(&resName, &resEnv, &issuedAt, &status,
+	err := db.QueryRow(sSql, key, tenantId).Scan(&resName, &resEnv, &issuedAt, &status,
 		&redirectionURIs, &developerAppName, &developerId)
 	switch {
 	case err == sql.ErrNoRows:
@@ -126,8 +144,6 @@
 
 	}
 
-	env := getEnvByScopeUUID(scopeuuid);
-
 	/* Verify if the ENV matches */
 	result = validateEnv(resEnv, env)
 	if result == false {
diff --git a/listener_test.go b/listener_test.go
index e50fe0e..a8da554 100644
--- a/listener_test.go
+++ b/listener_test.go
@@ -200,7 +200,7 @@
 				v := url.Values{
 					"key": []string{"ch_app_credential_0"},
 					"uriPath": []string{"/test"},
-					"scopeuuid": []string{"ABCDE"},
+					"scopeuuid": []string{"XYZ"},
 					"action": []string{"verify"},
 				}
 				rsp, err := verifyAPIKey(v)
diff --git a/verifyAPIKey_suite_test.go b/verifyAPIKey_suite_test.go
index d1f8e6d..870a376 100644
--- a/verifyAPIKey_suite_test.go
+++ b/verifyAPIKey_suite_test.go
@@ -293,6 +293,16 @@
 		"ABCDE",
 		"some_cluster_id",
 		"some_cluster_id",
+		"tenant_id_xxxx",
+		"test_org0",
+		"Env_0",
+	);
+	txn.Exec("INSERT INTO DATA_SCOPE (id, _change_selector, apid_cluster_id, scope, org, env) " +
+		"VALUES" +
+		"($1,$2,$3,$4,$5,$6)",
+		"XYZ",
+		"test_org0",
+		"somecluster_id",
 		"tenant_id_0",
 		"test_org0",
 		"Env_0",