diff --git a/manager/api/endpoint.go b/manager/api/endpoint.go
index ccdffb6a..128fb6c5 100644
--- a/manager/api/endpoint.go
+++ b/manager/api/endpoint.go
@@ -37,24 +37,6 @@ func loginEndpoint(svc manager.Service) endpoint.Endpoint {
 	}
 }
 
-func identityEndpoint(svc manager.Service) endpoint.Endpoint {
-	return func(_ context.Context, request interface{}) (interface{}, error) {
-		req := request.(identityReq)
-
-		if err := req.validate(); err != nil {
-			return nil, manager.ErrUnauthorizedAccess
-		}
-
-		id, err := svc.Identity(req.key)
-		if err != nil {
-			return nil, err
-		}
-
-		res := identityRes{id: id}
-		return res, nil
-	}
-}
-
 func addClientEndpoint(svc manager.Service) endpoint.Endpoint {
 	return func(_ context.Context, request interface{}) (interface{}, error) {
 		req := request.(addClientReq)
@@ -235,6 +217,23 @@ func removeChannelEndpoint(svc manager.Service) endpoint.Endpoint {
 	}
 }
 
+func identityEndpoint(svc manager.Service) endpoint.Endpoint {
+	return func(_ context.Context, request interface{}) (interface{}, error) {
+		req := request.(identityReq)
+
+		if err := req.validate(); err != nil {
+			return nil, manager.ErrUnauthorizedAccess
+		}
+
+		id, err := svc.Identity(req.key)
+		if err != nil {
+			return nil, err
+		}
+
+		return identityRes{id: id}, nil
+	}
+}
+
 func canAccessEndpoint(svc manager.Service) endpoint.Endpoint {
 	return func(_ context.Context, request interface{}) (interface{}, error) {
 		req := request.(viewResourceReq)
@@ -243,10 +242,11 @@ func canAccessEndpoint(svc manager.Service) endpoint.Endpoint {
 			return nil, manager.ErrUnauthorizedAccess
 		}
 
-		if allowed := svc.CanAccess(req.key, req.id); !allowed {
-			return nil, manager.ErrUnauthorizedAccess
+		id, err := svc.CanAccess(req.key, req.id)
+		if err != nil {
+			return nil, err
 		}
 
-		return accessRes{}, nil
+		return identityRes{id: id}, nil
 	}
 }
diff --git a/manager/api/logging.go b/manager/api/logging.go
index 42377c7b..ace68336 100644
--- a/manager/api/logging.go
+++ b/manager/api/logging.go
@@ -45,19 +45,6 @@ func (ls *loggingService) Login(user manager.User) (token string, err error) {
 	return ls.Service.Login(user)
 }
 
-func (ls *loggingService) Identity(key string) (id string, err error) {
-	defer func(begin time.Time) {
-		ls.logger.Log(
-			"method", "identity",
-			"id", id,
-			"error", err,
-			"took", time.Since(begin),
-		)
-	}(time.Now())
-
-	return ls.Service.Identity(key)
-}
-
 func (ls *loggingService) AddClient(key string, client manager.Client) (id string, err error) {
 	defer func(begin time.Time) {
 		ls.logger.Log(
@@ -196,6 +183,19 @@ func (ls *loggingService) RemoveChannel(key string, id string) (err error) {
 	return ls.Service.RemoveChannel(key, id)
 }
 
+func (ls *loggingService) Identity(key string) (id string, err error) {
+	defer func(begin time.Time) {
+		ls.logger.Log(
+			"method", "identity",
+			"id", id,
+			"error", err,
+			"took", time.Since(begin),
+		)
+	}(time.Now())
+
+	return ls.Service.Identity(key)
+}
+
 func (ls *loggingService) CanAccess(key string, id string) (allowed bool) {
 	defer func(begin time.Time) {
 		ls.logger.Log(
diff --git a/manager/api/metrics.go b/manager/api/metrics.go
index 0fbd868f..f9bd6353 100644
--- a/manager/api/metrics.go
+++ b/manager/api/metrics.go
@@ -43,15 +43,6 @@ func (ms *metricService) Login(user manager.User) (string, error) {
 	return ms.Service.Login(user)
 }
 
-func (ms *metricService) Identity(key string) (string, error) {
-	defer func(begin time.Time) {
-		ms.counter.With("method", "identity").Add(1)
-		ms.latency.With("method", "identity").Observe(time.Since(begin).Seconds())
-	}(time.Now())
-
-	return ms.Service.Identity(key)
-}
-
 func (ms *metricService) AddClient(key string, client manager.Client) (string, error) {
 	defer func(begin time.Time) {
 		ms.counter.With("method", "add_client").Add(1)
@@ -142,6 +133,15 @@ func (ms *metricService) RemoveChannel(key string, id string) error {
 	return ms.Service.RemoveChannel(key, id)
 }
 
+func (ms *metricService) Identity(key string) (string, error) {
+	defer func(begin time.Time) {
+		ms.counter.With("method", "identity").Add(1)
+		ms.latency.With("method", "identity").Observe(time.Since(begin).Seconds())
+	}(time.Now())
+
+	return ms.Service.Identity(key)
+}
+
 func (ms *metricService) CanAccess(key string, id string) bool {
 	defer func(begin time.Time) {
 		ms.counter.With("method", "can_access").Add(1)
diff --git a/manager/api/responses.go b/manager/api/responses.go
index 6efa20db..e5af9ca1 100644
--- a/manager/api/responses.go
+++ b/manager/api/responses.go
@@ -21,7 +21,7 @@ type identityRes struct {
 
 func (res identityRes) headers() map[string]string {
 	return map[string]string{
-		"X-Client-Id": res.id,
+		"X-client-id": res.id,
 	}
 }
 
@@ -186,17 +186,3 @@ func (res listChannelsRes) headers() map[string]string {
 func (res listChannelsRes) empty() bool {
 	return false
 }
-
-type accessRes struct{}
-
-func (res accessRes) code() int {
-	return http.StatusAccepted
-}
-
-func (res accessRes) headers() map[string]string {
-	return map[string]string{}
-}
-
-func (res accessRes) empty() bool {
-	return true
-}
diff --git a/manager/api/transport.go b/manager/api/transport.go
index ad8b66b7..f8054793 100644
--- a/manager/api/transport.go
+++ b/manager/api/transport.go
@@ -34,13 +34,6 @@ func MakeHandler(svc manager.Service) http.Handler {
 		opts...,
 	))
 
-	r.Post("/identity", kithttp.NewServer(
-		identityEndpoint(svc),
-		decodeIdentity,
-		encodeResponse,
-		opts...,
-	))
-
 	r.Post("/clients", kithttp.NewServer(
 		addClientEndpoint(svc),
 		decodeClientCreation,
@@ -111,14 +104,14 @@ func MakeHandler(svc manager.Service) http.Handler {
 		opts...,
 	))
 
-	r.Get("/channels/:id/messages", kithttp.NewServer(
-		canAccessEndpoint(svc),
-		decodeView,
+	r.Get("/access-grant", kithttp.NewServer(
+		identityEndpoint(svc),
+		decodeIdentity,
 		encodeResponse,
 		opts...,
 	))
 
-	r.Post("/channels/:id/messages", kithttp.NewServer(
+	r.Get("/channels/:id/access-grant", kithttp.NewServer(
 		canAccessEndpoint(svc),
 		decodeView,
 		encodeResponse,