diff --git a/group/group.go b/group/group.go
index f1ccb23..6e1f475 100644
--- a/group/group.go
+++ b/group/group.go
@@ -1029,11 +1029,6 @@ func validUsername(username string) bool {
 
 // called locked
 func (g *Group) getPermission(creds ClientCredentials) (string, []string, error) {
-	if creds.Username != nil && !validUsername(*creds.Username) {
-		return "", nil, &NotAuthorisedError{
-			errors.New("invalid username"),
-		}
-	}
 	desc := g.description
 	var username string
 	var perms []string
@@ -1070,6 +1065,12 @@ func (g *Group) getPermission(creds ClientCredentials) (string, []string, error)
 		return "", nil, errors.New("neither username nor token provided")
 	}
 
+	if !validUsername(username) {
+		return "", nil, &NotAuthorisedError{
+			errors.New("invalid username"),
+		}
+	}
+
 	return username, perms, nil
 }