diff --git a/pkg/services/auth/auth.go b/pkg/services/auth/auth.go
index cc678914b31..76b60b68517 100644
--- a/pkg/services/auth/auth.go
+++ b/pkg/services/auth/auth.go
@@ -20,9 +20,10 @@ const (
 
 // Typed errors
 var (
-	ErrUserTokenNotFound       = errors.New("user token not found")
-	ErrInvalidSessionToken     = usertoken.ErrInvalidSessionToken
-	ErrExternalSessionNotFound = errors.New("external session not found")
+	ErrUserTokenNotFound            = errors.New("user token not found")
+	ErrInvalidSessionToken          = usertoken.ErrInvalidSessionToken
+	ErrExternalSessionNotFound      = errors.New("external session not found")
+	ErrExternalSessionTokenNotFound = errors.New("session token was nil")
 )
 
 type (
diff --git a/pkg/services/oauthtoken/oauth_token.go b/pkg/services/oauthtoken/oauth_token.go
index 2a5f75eeb7b..8a2195b5c40 100644
--- a/pkg/services/oauthtoken/oauth_token.go
+++ b/pkg/services/oauthtoken/oauth_token.go
@@ -648,6 +648,10 @@ func (o *Service) getExternalSession(ctx context.Context, usr identity.Requester
 		return externalSessions[0], nil
 	}
 
+	if sessionToken == nil {
+		return nil, auth.ErrExternalSessionTokenNotFound
+	}
+
 	// For regular users, we use the session token ID to fetch the external session
 	return o.sessionService.GetExternalSession(ctx, sessionToken.ExternalSessionId)
 }