diff --git a/lib/promscrape/discovery/consul/api.go b/lib/promscrape/discovery/consul/api.go
index 8eff2d8d0d..92eb3685cb 100644
--- a/lib/promscrape/discovery/consul/api.go
+++ b/lib/promscrape/discovery/consul/api.go
@@ -85,9 +85,9 @@ func newAPIConfig(sdc *SDConfig, baseDir string) (*apiConfig, error) {
 	return cfg, nil
 }
 
-func getToken(token string) (string, error) {
-	if token != "" {
-		return token, nil
+func getToken(token *string) (string, error) {
+	if token != nil {
+		return *token, nil
 	}
 	if tokenFile := os.Getenv("CONSUL_HTTP_TOKEN_FILE"); tokenFile != "" {
 		data, err := ioutil.ReadFile(tokenFile)
@@ -96,9 +96,9 @@ func getToken(token string) (string, error) {
 		}
 		return string(data), nil
 	}
-	token = os.Getenv("CONSUL_HTTP_TOKEN")
+	t := os.Getenv("CONSUL_HTTP_TOKEN")
 	// Allow empty token - it shouls work if authorization is disabled in Consul
-	return token, nil
+	return t, nil
 }
 
 func getDatacenter(client *discoveryutils.Client, dc string) (string, error) {
diff --git a/lib/promscrape/discovery/consul/consul.go b/lib/promscrape/discovery/consul/consul.go
index 38225ce8c9..9886d4e091 100644
--- a/lib/promscrape/discovery/consul/consul.go
+++ b/lib/promscrape/discovery/consul/consul.go
@@ -11,7 +11,7 @@ import (
 // See https://prometheus.io/docs/prometheus/latest/configuration/configuration/#consul_sd_config
 type SDConfig struct {
 	Server       string              `yaml:"server"`
-	Token        string              `yaml:"token"`
+	Token        *string             `yaml:"token"`
 	Datacenter   string              `yaml:"datacenter"`
 	Scheme       string              `yaml:"scheme"`
 	Username     string              `yaml:"username"`