diff --git a/plugins/scaffolder-backend/src/service/router.ts b/plugins/scaffolder-backend/src/service/router.ts
index 7ea794796d..18262a4f50 100644
--- a/plugins/scaffolder-backend/src/service/router.ts
+++ b/plugins/scaffolder-backend/src/service/router.ts
@@ -461,13 +461,18 @@ export async function createRouter(
         defaultKind: 'template',
       });
 
-      const credentials = await httpAuth.credentials(req, { allow: ['user'] });
+      // TODO(blam): This should be forced user auth eventually, but let's keep it as is for now,
+      // with the ability to do unauthenticated task creation.
+      const credentials = await httpAuth.credentials(req);
 
       const { token } = await auth.getPluginRequestToken({
         onBehalfOf: credentials,
         targetPluginId: 'catalog',
       });
-      const userEntityRef = credentials.principal.userEntityRef;
+
+      const userEntityRef = auth.isPrincipal(credentials, 'user')
+        ? credentials.principal.userEntityRef
+        : undefined;
 
       const userEntity = userEntityRef
         ? await catalogClient.getEntityByRef(userEntityRef, { token })