diff --git a/tests/Unit/Dto/Token/CreateTest.php b/tests/Unit/Dto/Token/CreateTest.php
new file mode 100644
index 000000000..3623e4543
--- /dev/null
+++ b/tests/Unit/Dto/Token/CreateTest.php
@@ -0,0 +1,27 @@
+<?php
+declare(strict_types=1);
+
+/**
+ * Pimcore
+ *
+ * This source file is available under following license:
+ * - Pimcore Commercial License (PCL)
+ *
+ *  @copyright  Copyright (c) Pimcore GmbH (http://www.pimcore.org)
+ *  @license    http://www.pimcore.org/license     PCL
+ */
+
+namespace Pimcore\Bundle\StudioApiBundle\Tests\Unit\Dto\Token;
+
+use Codeception\Test\Unit;
+use Pimcore\Bundle\StudioApiBundle\Dto\Token\Create;
+
+final class CreateTest extends Unit
+{
+    public function testTokenCreate(): void
+    {
+        $info = new Create('token', 'test');
+        $this->assertSame('token', $info->getUsername());
+        $this->assertSame('test', $info->getPassword());
+    }
+}
\ No newline at end of file
diff --git a/tests/Unit/Dto/Token/InfoTest.php b/tests/Unit/Dto/Token/InfoTest.php
new file mode 100644
index 000000000..d0dd3e32e
--- /dev/null
+++ b/tests/Unit/Dto/Token/InfoTest.php
@@ -0,0 +1,27 @@
+<?php
+declare(strict_types=1);
+
+/**
+ * Pimcore
+ *
+ * This source file is available under following license:
+ * - Pimcore Commercial License (PCL)
+ *
+ *  @copyright  Copyright (c) Pimcore GmbH (http://www.pimcore.org)
+ *  @license    http://www.pimcore.org/license     PCL
+ */
+
+namespace Pimcore\Bundle\StudioApiBundle\Tests\Unit\Dto\Token;
+
+use Codeception\Test\Unit;
+use Pimcore\Bundle\StudioApiBundle\Dto\Token\Info;
+
+final class InfoTest extends Unit
+{
+    public function testTokenInfo(): void
+    {
+        $info = new Info('token', 'test');
+        $this->assertSame('token', $info->getToken());
+        $this->assertSame('test', $info->getUsername());
+    }
+}
\ No newline at end of file
diff --git a/tests/Unit/Dto/Token/OutputTest.php b/tests/Unit/Dto/Token/OutputTest.php
new file mode 100644
index 000000000..9432283d1
--- /dev/null
+++ b/tests/Unit/Dto/Token/OutputTest.php
@@ -0,0 +1,28 @@
+<?php
+declare(strict_types=1);
+
+/**
+ * Pimcore
+ *
+ * This source file is available under following license:
+ * - Pimcore Commercial License (PCL)
+ *
+ *  @copyright  Copyright (c) Pimcore GmbH (http://www.pimcore.org)
+ *  @license    http://www.pimcore.org/license     PCL
+ */
+
+namespace Pimcore\Bundle\StudioApiBundle\Tests\Unit\Dto\Token;
+
+use Codeception\Test\Unit;
+use Pimcore\Bundle\StudioApiBundle\Dto\Token\Output;
+
+final class OutputTest extends Unit
+{
+    public function testTokenOutput(): void
+    {
+        $info = new Output('token',3600, 'test');
+        $this->assertSame('token', $info->getToken());
+        $this->assertSame(3600, $info->getLifetime());
+        $this->assertSame('test', $info->getUsername());
+    }
+}
\ No newline at end of file
diff --git a/tests/Unit/Dto/Token/RefreshTest.php b/tests/Unit/Dto/Token/RefreshTest.php
new file mode 100644
index 000000000..8f21e9efe
--- /dev/null
+++ b/tests/Unit/Dto/Token/RefreshTest.php
@@ -0,0 +1,26 @@
+<?php
+declare(strict_types=1);
+
+/**
+ * Pimcore
+ *
+ * This source file is available under following license:
+ * - Pimcore Commercial License (PCL)
+ *
+ *  @copyright  Copyright (c) Pimcore GmbH (http://www.pimcore.org)
+ *  @license    http://www.pimcore.org/license     PCL
+ */
+
+namespace Pimcore\Bundle\StudioApiBundle\Tests\Unit\Dto\Token;
+
+use Codeception\Test\Unit;
+use Pimcore\Bundle\StudioApiBundle\Dto\Token\Refresh;
+
+final class RefreshTest extends Unit
+{
+    public function testTokenRefresh(): void
+    {
+        $info = new Refresh('token');
+        $this->assertSame('token', $info->getToken());
+    }
+}
\ No newline at end of file
diff --git a/tests/Unit/Resources/Token/PostProcessorTest.php b/tests/Unit/Resources/Token/PostProcessorTest.php
deleted file mode 100644
index 2add9191e..000000000
--- a/tests/Unit/Resources/Token/PostProcessorTest.php
+++ /dev/null
@@ -1,66 +0,0 @@
-<?php
-
-/**
- * Pimcore
- *
- * This source file is available under following license:
- * - Pimcore Commercial License (PCL)
- *
- *  @copyright  Copyright (c) Pimcore GmbH (http://www.pimcore.org)
- *  @license    http://www.pimcore.org/license     PCL
- */
-
-namespace Pimcore\Bundle\StudioApiBundle\Tests\Unit\Token;
-
-use ApiPlatform\State\ProcessorInterface;
-use Codeception\Test\Unit;
-use Pimcore\Bundle\StaticResolverBundle\Models\Tool\TmpStoreResolverInterface;
-use Pimcore\Bundle\StudioApiBundle\State\Token\Processor;
-use Pimcore\Security\User\UserProvider;
-use Symfony\Component\PasswordHasher\Hasher\UserPasswordHasherInterface;
-use Symfony\Component\Security\Csrf\TokenGenerator\TokenGeneratorInterface;
-
-/**
- * @internal
- */
-final class PostProcessorTest extends Unit
-{
-    private const TOKEN_TTL = 3600;
-
-    public function testTokenCreate()
-    {
-        $processor = $this->mockProcessor();
-        $this->assertInstanceOf(ProcessorInterface::class, $processor);
-    }
-
-    private function mockProcessor(): ProcessorInterface
-    {
-        return new Processor(
-            $this->mockUserProvider(),
-            $this->mockTokenGenerator(),
-            $this->mockPasswordHasher(),
-            $this->mockTmpStoreResolver(),
-            self::TOKEN_TTL
-        );
-    }
-
-    private function mockUserProvider(): UserProvider
-    {
-        return $this->makeEmpty(UserProvider::class);
-    }
-
-    private function mockTokenGenerator(): TokenGeneratorInterface
-    {
-        return $this->makeEmpty(TokenGeneratorInterface::class);
-    }
-
-    private function mockPasswordHasher(): UserPasswordHasherInterface
-    {
-        return $this->makeEmpty(UserPasswordHasherInterface::class);
-    }
-
-    private function mockTmpStoreResolver(): TmpStoreResolverInterface
-    {
-        return $this->makeEmpty(TmpStoreResolverInterface::class);
-    }
-}
diff --git a/tests/Unit/Service/Security/SecurityServiceTest.php b/tests/Unit/Service/Security/SecurityServiceTest.php
new file mode 100644
index 000000000..ca120c3ff
--- /dev/null
+++ b/tests/Unit/Service/Security/SecurityServiceTest.php
@@ -0,0 +1,149 @@
+<?php
+declare(strict_types=1);
+
+/**
+ * Pimcore
+ *
+ * This source file is available under following license:
+ * - Pimcore Commercial License (PCL)
+ *
+ *  @copyright  Copyright (c) Pimcore GmbH (http://www.pimcore.org)
+ *  @license    http://www.pimcore.org/license     PCL
+ */
+
+namespace Pimcore\Bundle\StudioApiBundle\Tests\Unit\Service\Security;
+
+use Codeception\Test\Unit;
+use Exception;
+use Pimcore\Bundle\StaticResolverBundle\Models\Tool\TmpStoreResolverInterface;
+use Pimcore\Bundle\StudioApiBundle\Dto\Token\Create;
+use Pimcore\Bundle\StudioApiBundle\Service\SecurityService;
+use Pimcore\Bundle\StudioApiBundle\Service\SecurityServiceInterface;
+use Pimcore\Model\Tool\TmpStore;
+use Pimcore\Security\User\User;
+use Pimcore\Security\User\UserProvider;
+use Symfony\Component\PasswordHasher\Hasher\UserPasswordHasherInterface;
+use Symfony\Component\Security\Core\Exception\UserNotFoundException;
+
+
+final class SecurityServiceTest extends Unit
+{
+    /**
+     * @throws Exception
+     */
+    public function testSecurityService(): void
+    {
+        $securityService = $this->mockSecurityService();
+        $user = $securityService->authenticateUser(new Create('test', 'test'));
+
+        $this->assertInstanceOf(User::class, $user);
+        $this->assertSame('test', $user->getPassword());
+    }
+
+    /**
+     * @throws Exception
+     */
+
+    public function testInvalidPassword(): void
+    {
+        $securityService = $this->mockSecurityService(false);
+
+        $this->expectExceptionMessage('Invalid credentials');
+        $securityService->authenticateUser(new Create('test', 'test'));
+    }
+
+
+    /**
+     * @throws Exception
+     */
+    public function testUserNotFound(): void
+    {
+        $securityService = $this->mockSecurityService(false, false);
+
+        $this->expectExceptionMessage('Invalid credentials');
+        $securityService->authenticateUser(new Create('test', 'test'));
+    }
+
+    /**
+     * @throws Exception
+     */
+    public function testTokenAllowedTrue(): void
+    {
+        $securityService = $this->mockSecurityService(false, false);
+
+        $this->assertTrue($securityService->isAllowed('test'));
+    }
+
+    /**
+     * @throws Exception
+     */
+    public function testTokenAllowedFalse(): void
+    {
+        $securityService = $this->mockSecurityService(false, false, false);
+
+        $this->assertFalse($securityService->isAllowed('test'));
+    }
+
+    /**
+     * @throws Exception
+     */
+    private function mockSecurityService($validPassword = true, bool $withUser = true, bool $withTmpStore = true): SecurityServiceInterface
+    {
+        return new SecurityService(
+            $withUser ? $this->mockUserProviderWithUser() : $this->mockUserProviderWithOutUser(),
+            $this->mockPasswordHasher($validPassword),
+            $this->mockTmpStoreResolver($withTmpStore)
+        );
+    }
+
+    /**
+     * @throws Exception
+     */
+    private function mockUserProviderWithUser(): UserProvider
+    {
+        return $this->makeEmpty(UserProvider::class, [
+            'loadUserByIdentifier' => function() {
+                return $this->makeEmpty(User::class, [
+                    'getPassword' => 'test'
+                ]);
+            }
+        ]);
+    }
+
+    /**
+     * @throws Exception
+     */
+    private function mockUserProviderWithOutUser(): UserProvider
+    {
+        return $this->makeEmpty(UserProvider::class, [
+            'loadUserByIdentifier' => fn() => throw new UserNotFoundException('User not found')
+        ]);
+    }
+
+    /**
+     * @throws Exception
+     */
+    private function mockPasswordHasher($validPassword = true): UserPasswordHasherInterface
+    {
+        return $this->makeEmpty(UserPasswordHasherInterface::class, [
+            'isPasswordValid' => $validPassword
+        ]);
+    }
+
+    /**
+     * @throws Exception
+     */
+    private function mockTmpStoreResolver($withTmpStore = true): TmpStoreResolverInterface
+    {
+        return $this->makeEmpty(TmpStoreResolverInterface::class, [
+            'get' => $withTmpStore ? $this->mockTmpStore(): null
+        ]);
+    }
+
+    private function mockTmpStore(): TmpStore
+    {
+       $tmpStore = new TmpStore();
+       $tmpStore->setId('test');
+       return $tmpStore;
+    }
+}
\ No newline at end of file
diff --git a/tests/Unit/State/Token/Create/ProcessorTest.php b/tests/Unit/State/Token/Create/ProcessorTest.php
new file mode 100644
index 000000000..3552a550e
--- /dev/null
+++ b/tests/Unit/State/Token/Create/ProcessorTest.php
@@ -0,0 +1,113 @@
+<?php
+declare(strict_types=1);
+
+/**
+ * Pimcore
+ *
+ * This source file is available under following license:
+ * - Pimcore Commercial License (PCL)
+ *
+ *  @copyright  Copyright (c) Pimcore GmbH (http://www.pimcore.org)
+ *  @license    http://www.pimcore.org/license     PCL
+ */
+
+namespace Pimcore\Bundle\StudioApiBundle\Tests\Unit\State\Token\Create;
+
+use ApiPlatform\Exception\OperationNotFoundException;
+use ApiPlatform\Metadata\Get;
+use ApiPlatform\Metadata\Post;
+use Codeception\Test\Unit;
+use Exception;
+use Pimcore\Bundle\StudioApiBundle\Dto\Token\Create;
+use Pimcore\Bundle\StudioApiBundle\Service\SecurityServiceInterface;
+use Pimcore\Bundle\StudioApiBundle\Service\TokenServiceInterface;
+use Pimcore\Bundle\StudioApiBundle\State\Token\Create\Processor;
+use stdClass;
+
+final class ProcessorTest extends Unit
+{
+    /**
+     * @throws Exception
+     */
+    public function testWrongUriTemplate(): void
+    {
+        $translationProcessor = $this->mockProcessor();
+
+        $this->expectException(OperationNotFoundException::class);
+
+        $translationProcessor->process(
+            $this->getCreateToken(),
+            $this->getPostOperation('/wrong-uri-template')
+        );
+    }
+
+    /**
+     * @throws Exception
+     */
+
+    public function testWrongOperation(): void
+    {
+        $translationProcessor = $this->mockProcessor();
+
+        $this->expectException(OperationNotFoundException::class);
+
+        $translationProcessor->process(
+            $this->getCreateToken(),
+            $this->getGetOperation()
+        );
+    }
+
+    /**
+     * @throws Exception
+     */
+    public function testWrongData(): void
+    {
+        $translationProcessor = $this->mockProcessor();
+
+        $this->expectException(OperationNotFoundException::class);
+
+        $translationProcessor->process(
+            new stdClass(),
+            $this->getPostOperation('/token/create')
+        );
+    }
+
+    /**
+     * @throws Exception
+     */
+    private function mockProcessor(): Processor
+    {
+        return new Processor($this->mockSecuritySercice(), $this->mockTokenService());
+    }
+
+    /**
+     * @throws Exception
+     */
+    private function mockSecuritySercice(): SecurityServiceInterface
+    {
+        return $this->makeEmpty(SecurityServiceInterface::class);
+    }
+
+    /**
+     * @throws Exception
+     */
+    private function mockTokenService(): TokenServiceInterface
+    {
+        return $this->makeEmpty(TokenServiceInterface::class);
+    }
+
+    private function getCreateToken(): Create
+    {
+        return new Create('test', 'test');
+    }
+
+    private function getPostOperation(string $uriTemplate): Post
+    {
+        return new Post(uriTemplate: $uriTemplate);
+    }
+
+    private function getGetOperation(): Get
+    {
+        return new Get(uriTemplate: '/token/create');
+    }
+}
\ No newline at end of file
diff --git a/tests/Unit/State/Token/Refresh/ProcessorTest.php b/tests/Unit/State/Token/Refresh/ProcessorTest.php
new file mode 100644
index 000000000..466d442e4
--- /dev/null
+++ b/tests/Unit/State/Token/Refresh/ProcessorTest.php
@@ -0,0 +1,104 @@
+<?php
+declare(strict_types=1);
+
+/**
+ * Pimcore
+ *
+ * This source file is available under following license:
+ * - Pimcore Commercial License (PCL)
+ *
+ *  @copyright  Copyright (c) Pimcore GmbH (http://www.pimcore.org)
+ *  @license    http://www.pimcore.org/license     PCL
+ */
+
+namespace Pimcore\Bundle\StudioApiBundle\Tests\Unit\State\Token\Refresh;
+
+use ApiPlatform\Exception\OperationNotFoundException;
+use ApiPlatform\Metadata\Get;
+use ApiPlatform\Metadata\Post;
+use Codeception\Test\Unit;
+use Exception;
+use Pimcore\Bundle\StudioApiBundle\Dto\Token\Create;
+use Pimcore\Bundle\StudioApiBundle\Service\TokenServiceInterface;
+use Pimcore\Bundle\StudioApiBundle\State\Token\Refresh\Processor;
+use stdClass;
+
+final class ProcessorTest extends Unit
+{
+    /**
+     * @throws Exception
+     */
+    public function testWrongUriTemplate(): void
+    {
+        $translationProcessor = $this->mockProcessor();
+
+        $this->expectException(OperationNotFoundException::class);
+
+        $translationProcessor->process(
+            $this->getCreateToken(),
+            $this->getPostOperation('/wrong-uri-template')
+        );
+    }
+
+    /**
+     * @throws Exception
+     */
+
+    public function testWrongOperation(): void
+    {
+        $translationProcessor = $this->mockProcessor();
+
+        $this->expectException(OperationNotFoundException::class);
+
+        $translationProcessor->process(
+            $this->getCreateToken(),
+            $this->getGetOperation()
+        );
+    }
+
+    /**
+     * @throws Exception
+     */
+    public function testWrongData(): void
+    {
+        $translationProcessor = $this->mockProcessor();
+
+        $this->expectException(OperationNotFoundException::class);
+
+        $translationProcessor->process(
+            new stdClass(),
+            $this->getPostOperation('/token/refresh')
+        );
+    }
+
+    /**
+     * @throws Exception
+     */
+    private function mockProcessor(): Processor
+    {
+        return new Processor($this->mockTokenService());
+    }
+
+    /**
+     * @throws Exception
+     */
+    private function mockTokenService(): TokenServiceInterface
+    {
+        return $this->makeEmpty(TokenServiceInterface::class);
+    }
+
+    private function getCreateToken(): Create
+    {
+        return new Create('test', 'test');
+    }
+
+    private function getPostOperation(string $uriTemplate): Post
+    {
+        return new Post(uriTemplate: $uriTemplate);
+    }
+
+    private function getGetOperation(): Get
+    {
+        return new Get(uriTemplate: '/token/refresh');
+    }
+}
\ No newline at end of file