diff --git a/api/blueprints/mail/tags/update.py b/api/blueprints/mail/tags/update.py
index cf71c4e..21fb068 100644
--- a/api/blueprints/mail/tags/update.py
+++ b/api/blueprints/mail/tags/update.py
@@ -70,6 +70,7 @@ from shared import constants
 
 # Data Models:
 from models.api.mail.tags import MailUpdateTagsRequestHeaders, MailUpdateTagsRequestData
+from models.core.user import CoreUserInfoModel
 
 # To work with datatypes:
 from typing import Literal
@@ -80,6 +81,9 @@ import asyncio
 # To work with date and time:
 import datetime
 
+# Helpers:
+from api.helpers.user import token_check
+
 
 #   *****************************************************************************************************************
 #  *****                                                                                                          ****
@@ -167,6 +171,32 @@ async def update_mail_tags(
             http_code = HttpCodes.UNAUTHORIZED
         )
 
+    # ┏┓    ┓   ┳┳┓  •┓
+    # ┣ ┏┓╋┏┣┓  ┃┃┃┏┓┓┃
+    # ┻ ┗ ┗┗┛┗  ┛ ┗┗┻┗┗
+
+    # Get the mail:
+    message = await current_app.mail_controller.get_one_mail(
+        mongo_conn = current_app.data_mongo,
+        message_id = inbound_data.messageId
+    )
+
+    # ┏┓          ┓ •    ┏┓┓    ┓
+    # ┃┃┓┏┏┏┓┏┓┏┓┏┣┓┓┏┓  ┃ ┣┓┏┓┏┃┏
+    # ┗┛┗┻┛┛┗┗ ┛ ┛┛┗┗┣┛  ┗┛┛┗┗ ┗┛┗
+    #                ┛
+
+    # We check if the token that was used to fetch the mail is owned by this user:
+    if not await token_check.is_authorized(
+            mongo_conn=current_app.data_mongo,
+            user_info = CoreUserInfoModel(**kwargs["session_info"]),
+            token_ids = [message.tokenId]
+    ): return ResponseModel(
+        status_code = StatusCodes.FAILED,
+        http_code = HttpCodes.UNAUTHORIZED,
+        message = "The message does not belong to this user."
+    )
+
     # ┳┳   ┓       ┳┳┓  •┓
     # ┃┃┏┓┏┫┏┓╋┏┓  ┃┃┃┏┓┓┃
     # ┗┛┣┛┗┻┗┻┗┗   ┛ ┗┗┻┗┗
@@ -175,12 +205,16 @@ async def update_mail_tags(
     # Update the mail:
     success = await current_app.mail_controller.update_tags(
         mongo_conn = current_app.data_mongo,
-        token_id = auth_token.authTokenId,
         message_id = inbound_data.messageId,
         unset_tags = inbound_data.unsetTags,
         set_tags = inbound_data.setTags
     )
 
+    # ┳┓
+    # ┣┫┏┓┏┏┓┏┓┏┓┏┏┓
+    # ┛┗┗ ┛┣┛┗┛┛┗┛┗
+    #      ┛
+
     # Done here:
     return ResponseModel(
         status_code = StatusCodes.OK if success else StatusCodes.FAILED,
diff --git a/controllers/api/mail.py b/controllers/api/mail.py
index be8a6ec..39aee51 100644
--- a/controllers/api/mail.py
+++ b/controllers/api/mail.py
@@ -628,7 +628,6 @@ class MailController:
     @staticmethod
     async def update_tags(
             mongo_conn: AsyncMongo,
-            token_id: ObjectId | str,
             message_id: ObjectId | str,
             unset_tags: List[str] = None,
             set_tags: List[str] = None
@@ -637,7 +636,6 @@ class MailController:
         # Simply call the core model:
         return await current_app.core_message_controller.update_tags(
             mongo_conn = mongo_conn,
-            token_id = token_id,
             message_id = message_id,
             unset_tags = unset_tags,
             set_tags = set_tags
diff --git a/controllers/core/auth_token.py b/controllers/core/auth_token.py
index 3c55470..638c8f2 100644
--- a/controllers/core/auth_token.py
+++ b/controllers/core/auth_token.py
@@ -296,7 +296,7 @@ class CoreAuthTokenController(BaseModel):
     async def get_token_from_key(
             self,
             mongo_conn: AsyncMongo,
-            token_key: ObjectId | str = None
+            token_key: ObjectId | str = None,
     ) -> CoreAuthTokenModel | None:
 
         """
diff --git a/models/api/mail/tags.py b/models/api/mail/tags.py
index 854e6e6..dc2a39f 100644
--- a/models/api/mail/tags.py
+++ b/models/api/mail/tags.py
@@ -101,11 +101,6 @@ class MailUpdateTagsRequestHeaders(BaseModel):
 
 class MailUpdateTagsRequestData(BaseModel):
 
-    tokenKey: str = Field(
-        description = "the id of the token associated with the mail; needed for security",
-        frozen = True
-    )
-
     messageId: str = Field(
         description = "the mail identifier (Mongo ObjectId) of the document that holds the mail",
         frozen = True