diff --git a/token/stateful.go b/token/stateful.go
index e436041..eec413f 100644
--- a/token/stateful.go
+++ b/token/stateful.go
@@ -94,6 +94,9 @@ func (token *Stateful) match(group string) bool {
 		return true
 	}
 	if token.IncludeSubgroups {
+		if token.Group == "" {
+			return true
+		}
 		return strings.HasPrefix(group, token.Group + "/")
 	}
 	return false
diff --git a/token/stateful_test.go b/token/stateful_test.go
index c42b4ee..eeaae35 100644
--- a/token/stateful_test.go
+++ b/token/stateful_test.go
@@ -80,6 +80,22 @@ func TestStatefulCheck(t *testing.T) {
 		Permissions:      []string{"present", "message"},
 		Expires:          &future,
 	}
+	token6 := &Stateful{
+		Token:            "token",
+		Group:            "",
+		IncludeSubgroups: false,
+		Username:         &user,
+		Permissions:      []string{"present", "message"},
+		Expires:          &future,
+	}
+	token7 := &Stateful{
+		Token:            "token",
+		Group:            "",
+		IncludeSubgroups: true,
+		Username:         &user,
+		Permissions:      []string{"present", "message"},
+		Expires:          &future,
+	}
 
 	success := []struct {
 		token          *Stateful
@@ -129,6 +145,13 @@ func TestStatefulCheck(t *testing.T) {
 			expUsername:    "user",
 			expPermissions: []string{"present", "message"},
 		},
+		{
+			token:          token7,
+			group:          "group/subgroup",
+			username:       &user,
+			expUsername:    "user",
+			expPermissions: []string{"present", "message"},
+		},
 	}
 
 	for i, s := range success {
@@ -166,6 +189,21 @@ func TestStatefulCheck(t *testing.T) {
 			group:    "groups",
 			username: &user,
 		},
+		{
+			token:    token6,
+			group:    "",
+			username: &user,
+		},
+		{
+			token:    token6,
+			group:    "group",
+			username: &user,
+		},
+		{
+			token:    token7,
+			group:    "",
+			username: &user,
+		},
 	}
 
 	for i, s := range failure {
diff --git a/webserver/api.go b/webserver/api.go
index 7d7c5be..59a3217 100644
--- a/webserver/api.go
+++ b/webserver/api.go
@@ -155,11 +155,10 @@ func apiHandler(w http.ResponseWriter, r *http.Request) {
 
 func apiGroupHandler(w http.ResponseWriter, r *http.Request, pth string) {
 	first, kind, rest := splitPath(pth)
-	if first == "" {
-		notFound(w)
-		return
+	g := ""
+	if first != "" {
+		g = first[1:]
 	}
-	g := first[1:]
 	if g == "" && kind == "" {
 		if apiCORS(w, r, "HEAD, GET") {
 			return
@@ -537,11 +536,13 @@ func tokensHandler(w http.ResponseWriter, r *http.Request, g, pth string) {
 		return
 	}
 
-	// check that the group exists
-	_, err := group.GetDescription(g)
-	if err != nil {
-		httpError(w, err)
-		return
+	if g != "" {
+		// check that the group exists
+		_, err := group.GetDescription(g)
+		if err != nil {
+			httpError(w, err)
+			return
+		}
 	}
 	if pth == "/" {
 		if r.Method == "HEAD" || r.Method == "GET" {
diff --git a/webserver/api_test.go b/webserver/api_test.go
index 4cc9cbf..86ac2ce 100644
--- a/webserver/api_test.go
+++ b/webserver/api_test.go
@@ -312,6 +312,12 @@ func TestApi(t *testing.T) {
 		t.Errorf("Create token: %v %v", err, resp.StatusCode)
 	}
 
+	resp, err = do("POST", "/galene-api/v0/.groups/.tokens/",
+		"application/json", "", "", "{\"includeSubgroups\": true}")
+	if err != nil || resp.StatusCode != http.StatusCreated {
+		t.Errorf("Create global token: %v %v", err, resp.StatusCode)
+	}
+
 	var toknames []string
 	err = getJSON("/galene-api/v0/.groups/test/.tokens/", &toknames)
 	if err != nil || len(toknames) != 1 {
@@ -319,6 +325,12 @@ func TestApi(t *testing.T) {
 	}
 	tokname := toknames[0]
 
+	var globalToknames []string
+	err = getJSON("/galene-api/v0/.groups/test/.tokens/", &globalToknames)
+	if err != nil || len(globalToknames) != 1 {
+		t.Errorf("Get global tokens: %v %v", err, globalToknames)
+	}
+
 	tokens, etag, err := token.List("test")
 	if err != nil || len(tokens) != 1 || tokens[0].Token != tokname {
 		t.Errorf("token.List: %v %v", tokens, err)