diff --git a/src/qr.rs b/src/qr.rs
index e9db37f44..fcefaf13a 100644
--- a/src/qr.rs
+++ b/src/qr.rs
@@ -383,7 +383,7 @@ async fn decode_openpgp(context: &Context, qr: &str) -> Result<Qr> {
                 .await
                 .with_context(|| format!("can't check if address {addr:?} is our address"))?
             {
-                if token::exists(context, token::Namespace::InviteNumber, &invitenumber).await {
+                if token::exists(context, token::Namespace::InviteNumber, &invitenumber).await? {
                     Ok(Qr::WithdrawVerifyGroup {
                         grpname,
                         grpid,
@@ -413,7 +413,7 @@ async fn decode_openpgp(context: &Context, qr: &str) -> Result<Qr> {
                 })
             }
         } else if context.is_self_addr(&addr).await? {
-            if token::exists(context, token::Namespace::InviteNumber, &invitenumber).await {
+            if token::exists(context, token::Namespace::InviteNumber, &invitenumber).await? {
                 Ok(Qr::WithdrawVerifyContact {
                     contact_id,
                     fingerprint,
diff --git a/src/securejoin.rs b/src/securejoin.rs
index 06480a437..dc2321ee9 100644
--- a/src/securejoin.rs
+++ b/src/securejoin.rs
@@ -314,7 +314,7 @@ pub(crate) async fn handle_securejoin_handshake(
                     return Ok(HandshakeMessage::Ignore);
                 }
             };
-            if !token::exists(context, token::Namespace::InviteNumber, invitenumber).await {
+            if !token::exists(context, token::Namespace::InviteNumber, invitenumber).await? {
                 warn!(context, "Secure-join denied (bad invitenumber).");
                 return Ok(HandshakeMessage::Ignore);
             }
@@ -398,7 +398,7 @@ pub(crate) async fn handle_securejoin_handshake(
                 .await?;
                 return Ok(HandshakeMessage::Ignore);
             };
-            if !token::exists(context, token::Namespace::Auth, auth).await {
+            if !token::exists(context, token::Namespace::Auth, auth).await? {
                 could_not_establish_secure_connection(
                     context,
                     contact_id,
diff --git a/src/sync.rs b/src/sync.rs
index 64873298b..e719562a5 100644
--- a/src/sync.rs
+++ b/src/sync.rs
@@ -514,7 +514,7 @@ mod tests {
     async fn test_execute_sync_items() -> Result<()> {
         let t = TestContext::new_alice().await;
 
-        assert!(!token::exists(&t, Namespace::Auth, "yip-auth").await);
+        assert!(!token::exists(&t, Namespace::Auth, "yip-auth").await?);
 
         let sync_items = t
             .parse_sync_items(
@@ -537,10 +537,10 @@ mod tests {
                 .await?
                 .is_none()
         );
-        assert!(token::exists(&t, Namespace::InviteNumber, "yip-in").await);
-        assert!(token::exists(&t, Namespace::Auth, "yip-auth").await);
-        assert!(!token::exists(&t, Namespace::Auth, "non-existent").await);
-        assert!(!token::exists(&t, Namespace::Auth, "directly deleted").await);
+        assert!(token::exists(&t, Namespace::InviteNumber, "yip-in").await?);
+        assert!(token::exists(&t, Namespace::Auth, "yip-auth").await?);
+        assert!(!token::exists(&t, Namespace::Auth, "non-existent").await?);
+        assert!(!token::exists(&t, Namespace::Auth, "directly deleted").await?);
 
         Ok(())
     }
@@ -577,13 +577,13 @@ mod tests {
         let alice2 = TestContext::new_alice().await;
         alice2.set_config_bool(Config::SyncMsgs, true).await?;
         alice2.recv_msg(&sent_msg).await;
-        assert!(token::exists(&alice2, token::Namespace::Auth, "testtoken").await);
+        assert!(token::exists(&alice2, token::Namespace::Auth, "testtoken").await?);
         assert_eq!(Chatlist::try_load(&alice2, 0, None, None).await?.len(), 0);
 
         // the same sync message sent to bob must not be executed
         let bob = TestContext::new_bob().await;
         bob.recv_msg(&sent_msg).await;
-        assert!(!token::exists(&bob, token::Namespace::Auth, "testtoken").await);
+        assert!(!token::exists(&bob, token::Namespace::Auth, "testtoken").await?);
 
         Ok(())
     }
diff --git a/src/token.rs b/src/token.rs
index 2db815864..993867b64 100644
--- a/src/token.rs
+++ b/src/token.rs
@@ -103,15 +103,15 @@ pub async fn lookup_or_new(
     token
 }
 
-pub async fn exists(context: &Context, namespace: Namespace, token: &str) -> bool {
-    context
+pub async fn exists(context: &Context, namespace: Namespace, token: &str) -> Result<bool> {
+    let exists = context
         .sql
         .exists(
             "SELECT COUNT(*) FROM tokens WHERE namespc=? AND token=?;",
             (namespace, token),
         )
-        .await
-        .unwrap_or_default()
+        .await?;
+    Ok(exists)
 }
 
 pub async fn delete(context: &Context, namespace: Namespace, token: &str) -> Result<()> {