diff --git a/src/main/java/com/googlesource/gerrit/plugins/oauth/CasOAuthService.java b/src/main/java/com/googlesource/gerrit/plugins/oauth/CasOAuthService.java
index d76769a..5f3e4a1 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/oauth/CasOAuthService.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/oauth/CasOAuthService.java
@@ -15,6 +15,7 @@
 package com.googlesource.gerrit.plugins.oauth;
 
 import static com.google.gerrit.json.OutputFormat.JSON;
+import static com.google.common.base.Strings.nullToEmpty;
 
 import com.github.scribejava.core.builder.ServiceBuilder;
 import com.github.scribejava.core.model.OAuth2AccessToken;
@@ -159,7 +160,9 @@
     try {
       OAuth2AccessToken accessToken = service.getAccessToken(rv.getValue());
       return new OAuthToken(
-          accessToken.getAccessToken(), accessToken.getTokenType(), accessToken.getRawResponse());
+          accessToken.getAccessToken(),
+          nullToEmpty(accessToken.getTokenType()),
+          accessToken.getRawResponse());
     } catch (InterruptedException | ExecutionException | IOException e) {
       String msg = "Cannot retrieve access token";
       log.error(msg, e);