diff --git a/src/c3nav/control/templates/control/user.html b/src/c3nav/control/templates/control/user.html
index 960dc003..b50357db 100644
--- a/src/c3nav/control/templates/control/user.html
+++ b/src/c3nav/control/templates/control/user.html
@@ -26,7 +26,7 @@
     {% if request.user_permissions.grant_permissions or request.user == user %}
         <h4>{% trans 'API secret' %}</h4>
         <p>
-            {% if request.user_permissions.api_secret %}
+            {% if user.permissions.api_secret %}
                 {% if request.user == user %}
                     {% trans 'This user has an API secret.' %}
                 {% else %}
@@ -42,7 +42,7 @@
             {% csrf_token %}
             <select name="api_secret" style="width: auto;">
                 <option value="">---</option>
-                {% if request.user_permissions.api_secret %}
+                {% if user.permissions.api_secret %}
                     <option value="regenerate">{% trans 'Regenerate API secret' %}</option>
                     <option value="delete">{% trans 'Delete API secret' %}</option>
                 {% else %}
diff --git a/src/c3nav/control/views.py b/src/c3nav/control/views.py
index 7d7ff1dd..5406673c 100644
--- a/src/c3nav/control/views.py
+++ b/src/c3nav/control/views.py
@@ -80,7 +80,7 @@ def user_detail(request, user):
 
         api_secret_action = request.POST.get('api_secret')
         if (api_secret_action and (request.user_permissions.grant_permissions or
-                                   request.user == user and user.permissions.api_secret)):
+                                   (request.user == user and user.permissions.api_secret))):
 
             permissions = user.permissions