diff --git a/http.go b/http.go
index 3b1fd05..088418f 100644
--- a/http.go
+++ b/http.go
@@ -144,6 +144,7 @@ func buildHandler() (http.Handler, error) {
 	// ActivityPub and stuff
 	if appConfig.ActivityPub.Enabled {
 		r.Post("/activitypub/inbox/{blog}", apHandleInbox)
+		r.Post("/activitypub/{blog}/inbox", apHandleInbox)
 		r.Get("/.well-known/webfinger", apHandleWebfinger)
 		r.Get("/.well-known/host-meta", handleWellKnownHostMeta)
 	}
diff --git a/indieAuthServer.go b/indieAuthServer.go
index 4f6defe..0c6f4d9 100644
--- a/indieAuthServer.go
+++ b/indieAuthServer.go
@@ -268,8 +268,10 @@ func (data *indieAuthData) saveToken() (err error) {
 
 func verifyIndieAuthToken(token string) (data *indieAuthData, err error) {
 	token = strings.ReplaceAll(token, "Bearer ", "")
-	data = &indieAuthData{}
-	row, err := appDbQueryRow("select time, token, me, client, scope from indieauthtoken where token = ?", token)
+	data = &indieAuthData{
+		Scopes: []string{},
+	}
+	row, err := appDbQueryRow("select time, token, me, client, scope from indieauthtoken where token = @token", sql.Named("token", token))
 	if err != nil {
 		return nil, err
 	}