diff --git a/scm-webapp/src/main/java/sonia/scm/security/ApiKeyCollection.java b/scm-webapp/src/main/java/sonia/scm/security/ApiKeyCollection.java
index f25f4a7a12..6f21a55e03 100644
--- a/scm-webapp/src/main/java/sonia/scm/security/ApiKeyCollection.java
+++ b/scm-webapp/src/main/java/sonia/scm/security/ApiKeyCollection.java
@@ -49,8 +49,13 @@ class ApiKeyCollection {
   private Collection<ApiKeyWithPassphrase> keys;
 
   public ApiKeyCollection add(ApiKeyWithPassphrase key) {
-    Collection<ApiKeyWithPassphrase> newKeys = new ArrayList<>(keys.size() + 1);
-    newKeys.addAll(keys);
+    Collection<ApiKeyWithPassphrase> newKeys;
+    if (keys == null) {
+      newKeys = new ArrayList<>();
+    } else {
+      newKeys = new ArrayList<>(keys.size() + 1);
+      newKeys.addAll(keys);
+    }
     newKeys.add(key);
     return new ApiKeyCollection(newKeys);
   }