diff --git a/lib/travis/api/app/endpoint/authorization.rb b/lib/travis/api/app/endpoint/authorization.rb
index c66b80af..e5c7d8aa 100644
--- a/lib/travis/api/app/endpoint/authorization.rb
+++ b/lib/travis/api/app/endpoint/authorization.rb
@@ -112,7 +112,7 @@ class Travis::Api::App
       # logged in at GitHub and already authorized Travis CI. It is therefore
       # recommended to redirect to [/auth/handshake](#/auth/handshake) if no
       # token is being received.
-      get '/post_message' do
+      get '/post_message', scope: :public do
         handshake do |user, token, target_origin|
           halt 403, invalid_target(target_origin) unless target_ok? target_origin
           rendered_user = Travis::Api.data(user, version: :v2)