diff --git a/internal/api/headers.go b/internal/api/headers.go
index 733afcd6b..acc61f4e5 100644
--- a/internal/api/headers.go
+++ b/internal/api/headers.go
@@ -7,6 +7,7 @@ import (
 	"github.com/gin-gonic/gin"
 
 	"github.com/photoprism/photoprism/internal/entity"
+	"github.com/photoprism/photoprism/internal/get"
 	"github.com/photoprism/photoprism/internal/session"
 )
 
@@ -52,6 +53,10 @@ func AddFileCountHeaders(c *gin.Context, filesCount, foldersCount int) {
 
 // AddTokenHeaders adds preview token headers to the response.
 func AddTokenHeaders(c *gin.Context, s *entity.Session) {
+	if get.Config().Public() {
+		return
+	}
+
 	if s.PreviewToken != "" {
 		c.Header("X-Preview-Token", s.PreviewToken)
 	}
diff --git a/internal/config/config_auth.go b/internal/config/config_auth.go
index c61a856c8..7f64b321f 100644
--- a/internal/config/config_auth.go
+++ b/internal/config/config_auth.go
@@ -91,7 +91,7 @@ func (c *Config) Auth() bool {
 
 // AuthMode returns the authentication mode.
 func (c *Config) AuthMode() string {
-	if c.options.Public || c.options.Demo {
+	if c.options.Public || c.Demo() {
 		return AuthModePublic
 	}