diff --git a/src/collaboration/SecondaryTokenAuthenticator.js b/src/collaboration/SecondaryTokenAuthenticator.js
index 0062d1f..494c2a5 100644
--- a/src/collaboration/SecondaryTokenAuthenticator.js
+++ b/src/collaboration/SecondaryTokenAuthenticator.js
@@ -40,17 +40,24 @@ export class SecondaryTokenAuthenticator {
       };
     }
 
-    const rawTravelDocId = this.extractTravelDocId(req);
-    if (!rawTravelDocId) {
+    const rawTravelDocId = payload?.travelItineraryId;
+    if (typeof rawTravelDocId !== "string" && typeof rawTravelDocId !== "number") {
       return {
         ok: false,
-        statusCode: 400,
-        message: "Missing travelItineraryId query parameter"
+        statusCode: 401,
+        message: "Secondary token must include travelItineraryId"
       };
     }
 
     const userId = String(rawUserId);
-    const travelDocId = rawTravelDocId;
+    const travelDocId = String(rawTravelDocId).trim();
+    if (!travelDocId) {
+      return {
+        ok: false,
+        statusCode: 401,
+        message: "Secondary token must include travelItineraryId"
+      };
+    }
 
     return {
       ok: true,
@@ -83,20 +90,6 @@ export class SecondaryTokenAuthenticator {
     return { ok: true, token };
   }
 
-  extractTravelDocId(req) {
-    const travelItineraryId = this.getRequestUrl(req).searchParams.get("travelItineraryId");
-    if (!travelItineraryId) {
-      return null;
-    }
-
-    const normalizedTravelItineraryId = travelItineraryId.trim();
-    if (!normalizedTravelItineraryId) {
-      return null;
-    }
-
-    return normalizedTravelItineraryId;
-  }
-
   isSecondaryTokenUsed(token) {
     this.pruneUsedSecondaryTokens();
     return this.usedSecondaryTokens.has(token);
diff --git a/src/index.js b/src/index.js
index 2d32d2c..2615e82 100644
--- a/src/index.js
+++ b/src/index.js
@@ -38,7 +38,7 @@ travelDocWebSocketServer.start();
 server.listen(port, () => {
   console.log(`HTTP server listening on http://localhost:${port}`);
   console.log(
-    `WebSocket server listening on ws://localhost:${port}?secondaryToken=Bearer%20{jwt}&travelItineraryId={travelItineraryId}`
+    `WebSocket server listening on ws://localhost:${port}?secondaryToken=Bearer%20{jwt}`
   );
   console.log(`Y-LevelDB path: ${yLeveldbPath}`);
 });