diff --git a/lib/noosfero/api/entities.rb b/lib/noosfero/api/entities.rb
index 8acb406..d825e66 100644
--- a/lib/noosfero/api/entities.rb
+++ b/lib/noosfero/api/entities.rb
@@ -156,7 +156,7 @@ module Noosfero
       end
 
       class UserLogin < User
-        expose :private_token, documentation: {type: 'String', desc: 'A valid authentication code for post/delete api actions'}
+        expose :private_token, documentation: {type: 'String', desc: 'A valid authentication code for post/delete api actions'}, if: lambda {|object, options| object.activated? }
       end
 
       class Task < Entity
diff --git a/test/unit/api/session_test.rb b/test/unit/api/session_test.rb
index 21cc2d5..ba6d88f 100644
--- a/test/unit/api/session_test.rb
+++ b/test/unit/api/session_test.rb
@@ -200,4 +200,14 @@ class SessionTest < ActiveSupport::TestCase
     assert_equal 404, last_response.status
   end
 
+  should 'not return private token when the registered user is inactive' do
+    params = {:login => "newuserapi", :password => "newuserapi", :password_confirmation => "newuserapi", :email => "newuserapi@email.com" }
+    post "/api/v1/register?#{params.to_query}"
+    assert_equal 201, last_response.status
+    json = JSON.parse(last_response.body)
+    assert !User['newuserapi'].activated?
+    assert !json['user']['activated']
+    assert !json['user']['private_token'].present?
+  end
+
 end
--
libgit2 0.21.2