diff --git a/Makefile b/Makefile
index 775a346..334a223 100644
--- a/Makefile
+++ b/Makefile
@@ -88,6 +88,7 @@ export FACETEC_API_URL ?= http://$(_HOST):8085
 # R2PS service URLs
 export R2PS_URL ?= http://$(_HOST):8443
 export R2PS_ADMIN_URL ?= http://$(_HOST):8444
+export R2PS_ADMIN_DEV_TOKEN ?= r2ps-e2e-dev-token-for-testing-only
 
 # VC Services URLs (external, for health checks from host)
 export VC_ISSUER_URL ?= http://$(_HOST):9000
diff --git a/docker-compose.r2ps.yml b/docker-compose.r2ps.yml
index 594810c..74996f5 100644
--- a/docker-compose.r2ps.yml
+++ b/docker-compose.r2ps.yml
@@ -72,6 +72,7 @@ services:
       R2PS_SESSION_TTL: "5m"
       # Admin API
       R2PS_ADMIN_LISTEN: ":8081"
+      R2PS_ADMIN_DEV_TOKEN: ${R2PS_ADMIN_DEV_TOKEN:-r2ps-e2e-dev-token-for-testing-only}
       # In-memory store for dev (no MongoDB needed)
     volumes:
       - r2ps-softhsm-tokens:/var/lib/softhsm/tokens
diff --git a/scripts/setup-r2ps.sh b/scripts/setup-r2ps.sh
index a5b5e32..2277c1d 100755
--- a/scripts/setup-r2ps.sh
+++ b/scripts/setup-r2ps.sh
@@ -19,6 +19,7 @@ set -euo pipefail
 # ---------------------------------------------------------------------------
 R2PS_URL="${R2PS_URL:-http://localhost:8443}"
 R2PS_ADMIN_URL="${R2PS_ADMIN_URL:-http://localhost:8444}"
+R2PS_ADMIN_DEV_TOKEN="${R2PS_ADMIN_DEV_TOKEN:-r2ps-e2e-dev-token-for-testing-only}"
 MAX_RETRIES=30
 RETRY_INTERVAL=2
 
@@ -68,7 +69,9 @@ wait_for_r2ps() {
 verify_admin_api() {
     info "Verifying R2PS admin API at ${R2PS_ADMIN_URL} ..."
     local status
-    status=$(curl -sf -o /dev/null -w "%{http_code}" "${R2PS_ADMIN_URL}/admin/store/keys" 2>&1) || true
+    status=$(curl -sf -o /dev/null -w "%{http_code}" \
+        -H "Authorization: Bearer ${R2PS_ADMIN_DEV_TOKEN}" \
+        "${R2PS_ADMIN_URL}/admin/store/keys" 2>&1) || true
     if [[ "$status" == "200" ]]; then
         ok "R2PS admin API accessible"
     else
@@ -85,13 +88,15 @@ show_status() {
     echo "  Admin API: ${R2PS_ADMIN_URL}"
 
     local key_count
-    key_count=$(curl -sf "${R2PS_ADMIN_URL}/admin/store/keys" 2>/dev/null \
+    key_count=$(curl -sf -H "Authorization: Bearer ${R2PS_ADMIN_DEV_TOKEN}" \
+        "${R2PS_ADMIN_URL}/admin/store/keys" 2>/dev/null \
         | python3 -c "import sys,json; print(len(json.load(sys.stdin)))" 2>/dev/null) || key_count="?"
     echo "  HSM keys:  ${key_count}"
 
     for category in ka wia; do
         local cat_count
-        cat_count=$(curl -sf "${R2PS_ADMIN_URL}/admin/store/statuses/${category}" 2>/dev/null \
+        cat_count=$(curl -sf -H "Authorization: Bearer ${R2PS_ADMIN_DEV_TOKEN}" \
+            "${R2PS_ADMIN_URL}/admin/store/statuses/${category}" 2>/dev/null \
             | python3 -c "import sys,json; d=json.load(sys.stdin); print(len(d.get('entries',d)) if isinstance(d,dict) else len(d))" 2>/dev/null) || cat_count="?"
         echo "  Status list (${category}): ${cat_count} entries"
     done