diff --git a/tests/test_auth.py b/tests/test_auth.py
new file mode 100644
index 0000000..814026c
--- /dev/null
+++ b/tests/test_auth.py
@@ -0,0 +1,37 @@
+"""
+Tests for Proxmox authentication helpers.
+"""
+
+import os
+from unittest.mock import patch
+
+import pytest
+
+from proxmox_mcp.utils.auth import load_auth_from_env, normalize_token_name
+
+
+def test_normalize_token_name_accepts_bare_name():
+    assert normalize_token_name("devin@pve", "devin-codex") == "devin-codex"
+
+
+def test_normalize_token_name_accepts_full_token_id():
+    assert normalize_token_name("devin@pve", "devin@pve!devin-codex") == "devin-codex"
+
+
+def test_normalize_token_name_rejects_mismatched_full_token_id():
+    with pytest.raises(ValueError, match="different user"):
+        normalize_token_name("devin@pve", "root@pam!devin-codex")
+
+
+def test_load_auth_from_env_normalizes_full_token_id():
+    env = {
+        "PROXMOX_USER": "devin@pve",
+        "PROXMOX_TOKEN_NAME": "devin@pve!devin-codex",
+        "PROXMOX_TOKEN_VALUE": "secret-value",
+    }
+    with patch.dict(os.environ, env, clear=False):
+        auth = load_auth_from_env()
+
+    assert auth.user == "devin@pve"
+    assert auth.token_name == "devin-codex"
+    assert auth.token_value == "secret-value"