diff --git a/internal/core/apikey/mysql_integration_test.go b/internal/core/apikey/mysql_integration_test.go
index 389c6a9..3dca76f 100644
--- a/internal/core/apikey/mysql_integration_test.go
+++ b/internal/core/apikey/mysql_integration_test.go
@@ -63,6 +63,22 @@ func TestGORMRepositoryMySQL(t *testing.T) {
 		if err := repository.Create(context.Background(), &key); err != nil {
 			return err
 		}
+		otherUser := model.User{
+			Email: fmt.Sprintf("api-key-other-%d@chorus.invalid", suffix), PasswordHash: "synthetic",
+			DisplayName: "Other API Key Test", Status: "active",
+		}
+		if err := tx.Create(&otherUser).Error; err != nil {
+			return err
+		}
+		if _, err := repository.ByIDForUser(context.Background(), key.ID, otherUser.ID); !errors.Is(err, ErrAPIKeyNotFound) {
+			return fmt.Errorf("cross-user API key read error = %v, want ErrAPIKeyNotFound", err)
+		}
+		duplicate := key
+		duplicate.ID = 0
+		duplicate.UserID = otherUser.ID
+		if err := repository.Create(context.Background(), &duplicate); err == nil {
+			return errors.New("duplicate public id was accepted")
+		}
 		loaded, err := repository.ByPublicID(context.Background(), publicID)
 		if err != nil || loaded.ID != key.ID || string(loaded.SecretHash) != string(hash[:]) {
 			return fmt.Errorf("load created api key: id=%d err=%w", loaded.ID, err)