diff --git a/src/java/com/threerings/bureau/server/BureauAuthenticator.java b/src/java/com/threerings/bureau/server/BureauAuthenticator.java
new file mode 100644
index 000000000..41738cf55
--- /dev/null
+++ b/src/java/com/threerings/bureau/server/BureauAuthenticator.java
@@ -0,0 +1,52 @@
+package com.threerings.bureau.server;
+
+import com.threerings.bureau.data.BureauCredentials;
+import com.threerings.presents.data.AuthCodes;
+import com.threerings.presents.net.AuthRequest;
+import com.threerings.presents.net.AuthResponse;
+import com.threerings.presents.net.AuthResponseData;
+import com.threerings.presents.server.ChainedAuthenticator;
+import com.threerings.presents.server.net.AuthingConnection;
+
+import static com.threerings.bureau.Log.log;
+
+/**
+ * Authenticates bureaus only.
+ */
+public class BureauAuthenticator extends ChainedAuthenticator
+{
+    /**
+     * Creates a new bureau authenticator.
+     */
+    public BureauAuthenticator (BureauRegistry registry)
+    {
+        _registry = registry;
+    }
+
+    @Override // from abstract ChainedAuthenticator
+    protected boolean shouldHandleConnection (AuthingConnection conn)
+    {
+        return (conn.getAuthRequest().getCredentials() instanceof BureauCredentials);
+    }
+
+    @Override // from Authenticator
+    protected void processAuthentication (
+        AuthingConnection conn, 
+        AuthResponse rsp)
+    {
+        AuthRequest req = conn.getAuthRequest();
+        BureauCredentials creds = (BureauCredentials)req.getCredentials();
+        String problem = _registry.checkToken(creds);
+
+        if (problem == null) {
+            rsp.getData().code = AuthResponseData.SUCCESS;
+
+        } else {
+            log.warning("Received invalid bureau auth request [creds=" + 
+                creds + "], problem: " + problem);
+            rsp.getData().code = AuthCodes.SERVER_ERROR;
+        }
+    }
+
+    protected BureauRegistry _registry;
+}
diff --git a/src/java/com/threerings/bureau/server/BureauRegistry.java b/src/java/com/threerings/bureau/server/BureauRegistry.java
index 2e5c3303f..3fe51ad49 100644
--- a/src/java/com/threerings/bureau/server/BureauRegistry.java
+++ b/src/java/com/threerings/bureau/server/BureauRegistry.java
@@ -125,26 +125,25 @@ public class BureauRegistry
 
     /**
      * Check the credentials to make sure this is one of our bureaus.
+     * @return null if all's well, otherwise a string describing the authentication failure
      */
-    public void authenticate (BureauCredentials creds)
-        throws AuthenticationException
+    public String checkToken (BureauCredentials creds)
     {
         Bureau bureau = _bureaus.get(creds.bureauId);
         if (bureau == null) {
-            throw new AuthenticationException(
-                "Bureau " + creds.bureauId + " not found");
+            return "Bureau " + creds.bureauId + " not found";
         }
 
         if (bureau.clientObj != null) {
-            throw new AuthenticationException(
-                "Bureau " + creds.bureauId + " already logged in");
+            return "Bureau " + creds.bureauId + " already logged in";
         }
 
         if (!bureau.token.equals(creds.sessionToken)) {
-            throw new AuthenticationException(
-                "Bureau " + creds.bureauId + 
-                " does not match credentials token");
+            return "Bureau " + creds.bureauId + 
+                " does not match credentials token";
         }
+
+        return null;
     }
 
     /**