diff --git a/Classes/BITAuthenticator.m b/Classes/BITAuthenticator.m
index f8e568185f..fa22a14391 100644
--- a/Classes/BITAuthenticator.m
+++ b/Classes/BITAuthenticator.m
@@ -14,6 +14,7 @@
 #import "BITHockeyAppClient.h"
 
 static NSString* const kBITAuthenticatorAuthTokenKey = @"BITAuthenticatorAuthTokenKey";
+static NSString* const kBITAuthenticatorAuthTokenVendorIdentifierKey = @"BITAuthenticatorAuthTokenVendorIdentifierKey";
 static NSString* const kBITAuthenticatorLastAuthenticatedVersionKey = @"BITAuthenticatorLastAuthenticatedVersionKey";
 
 @implementation BITAuthenticator {
@@ -459,6 +460,7 @@ static NSString* const kBITAuthenticatorLastAuthenticatedVersionKey = @"BITAuthe
 
 - (void) cleanupInternalStorage {
   [self removeKeyFromKeychain:kBITAuthenticatorAuthTokenKey];
+  [self removeKeyFromKeychain:kBITAuthenticatorAuthTokenVendorIdentifierKey];
   [self setLastAuthenticatedVersion:nil];
 }
 
@@ -486,15 +488,29 @@ static NSString* const kBITAuthenticatorLastAuthenticatedVersionKey = @"BITAuthe
     [self willChangeValueForKey:@"installationIdentification"];
     if(nil == authenticationToken) {
       [self removeKeyFromKeychain:kBITAuthenticatorAuthTokenKey];
+      [self removeKeyFromKeychain:kBITAuthenticatorAuthTokenVendorIdentifierKey];
     } else {
       [self addStringValueToKeychain:authenticationToken forKey:kBITAuthenticatorAuthTokenKey];
+      NSString *identifierForVendor = self.currentDevice.identifierForVendor.UUIDString;
+      [self addStringValueToKeychain:identifierForVendor forKey:kBITAuthenticatorAuthTokenVendorIdentifierKey];
     }
     [self didChangeValueForKey:@"installationIdentification"];
   }
 }
 
 - (NSString *)authenticationToken {
-  return [self stringValueFromKeychainForKey:kBITAuthenticatorAuthTokenKey];
+  NSString *authToken = [self stringValueFromKeychainForKey:kBITAuthenticatorAuthTokenKey];
+  if(nil == authToken) return nil;
+  
+  //check if this was generated on the same device we're running now
+  NSString *currentVendorUUIDString = self.currentDevice.identifierForVendor.UUIDString;
+  if(![currentVendorUUIDString isEqualToString:[self stringValueFromKeychainForKey:kBITAuthenticatorAuthTokenVendorIdentifierKey]]) {
+    BITHockeyLog(@"Vendor identifier mismatch for stored auth-token. Resetting.");
+    [self removeKeyFromKeychain:kBITAuthenticatorAuthTokenVendorIdentifierKey];
+    [self removeKeyFromKeychain:kBITAuthenticatorAuthTokenKey];
+    return nil;
+  }
+  return authToken;
 }
 
 - (void)setLastAuthenticatedVersion:(NSString *)lastAuthenticatedVersion {
diff --git a/Support/HockeySDKTests/BITAuthenticatorTests.m b/Support/HockeySDKTests/BITAuthenticatorTests.m
index 71a5320447..71bcf03208 100644
--- a/Support/HockeySDKTests/BITAuthenticatorTests.m
+++ b/Support/HockeySDKTests/BITAuthenticatorTests.m
@@ -27,6 +27,21 @@
 - (NSString*) uniqueIdentifier {return @"reallyUnique";}
 @end
 
+@interface MyDeviceWithIdentifierForVendor : MyDevice
+@property (copy) NSUUID *identifierForVendor;
+@end
+@implementation MyDeviceWithIdentifierForVendor
+
+- (id)init {
+  self = [super init];
+  if( self ) {
+    _identifierForVendor = [NSUUID UUID];
+  }
+  return self;
+}
+
+@end
+
 static void *kInstallationIdentification = &kInstallationIdentification;
 
 @interface BITAuthenticatorTests : SenTestCase
@@ -325,4 +340,14 @@ static void *kInstallationIdentification = &kInstallationIdentification;
   assertThat(error, nilValue());
 }
 
+- (void) testThatAuthTokenIsResettingWhenVendorIdentifierChanged {
+  MyDeviceWithIdentifierForVendor *device = [MyDeviceWithIdentifierForVendor new];
+  _sut.currentDevice = (id)device;
+  [_sut didAuthenticateWithToken:@"SuperToken"];
+  NSString *ident = [_sut installationIdentification];
+  assertThat(ident, equalTo(@"SuperToken"));
+  device.identifierForVendor = [NSUUID UUID];
+  ident = [_sut installationIdentification];
+  assertThat(ident, isNot(equalTo(@"SuperToken")));
+}
 @end