diff --git a/module/Core/test-db/Domain/Repository/DomainRepositoryTest.php b/module/Core/test-db/Domain/Repository/DomainRepositoryTest.php
index c553821e..d377e326 100644
--- a/module/Core/test-db/Domain/Repository/DomainRepositoryTest.php
+++ b/module/Core/test-db/Domain/Repository/DomainRepositoryTest.php
@@ -9,12 +9,13 @@ use Shlinkio\Shlink\Core\Entity\Domain;
 use Shlinkio\Shlink\Core\Entity\ShortUrl;
 use Shlinkio\Shlink\Core\Model\ShortUrlMeta;
 use Shlinkio\Shlink\Core\ShortUrl\Resolver\ShortUrlRelationResolverInterface;
+use Shlinkio\Shlink\Rest\ApiKey\Model\RoleDefinition;
 use Shlinkio\Shlink\Rest\Entity\ApiKey;
 use Shlinkio\Shlink\TestUtils\DbTest\DatabaseTestCase;
 
 class DomainRepositoryTest extends DatabaseTestCase
 {
-    protected const ENTITIES_TO_EMPTY = [ShortUrl::class, Domain::class];
+    protected const ENTITIES_TO_EMPTY = [ShortUrl::class, Domain::class, ApiKey::class];
 
     private DomainRepository $repo;
 
@@ -28,18 +29,15 @@ class DomainRepositoryTest extends DatabaseTestCase
     {
         $fooDomain = new Domain('foo.com');
         $this->getEntityManager()->persist($fooDomain);
-        $fooShortUrl = $this->createShortUrl($fooDomain);
-        $this->getEntityManager()->persist($fooShortUrl);
+        $this->getEntityManager()->persist($this->createShortUrl($fooDomain));
 
         $barDomain = new Domain('bar.com');
         $this->getEntityManager()->persist($barDomain);
-        $barShortUrl = $this->createShortUrl($barDomain);
-        $this->getEntityManager()->persist($barShortUrl);
+        $this->getEntityManager()->persist($this->createShortUrl($barDomain));
 
         $bazDomain = new Domain('baz.com');
         $this->getEntityManager()->persist($bazDomain);
-        $bazShortUrl = $this->createShortUrl($bazDomain);
-        $this->getEntityManager()->persist($bazShortUrl);
+        $this->getEntityManager()->persist($this->createShortUrl($bazDomain));
 
         $detachedDomain = new Domain('detached.com');
         $this->getEntityManager()->persist($detachedDomain);
@@ -52,11 +50,49 @@ class DomainRepositoryTest extends DatabaseTestCase
         self::assertEquals([$barDomain, $fooDomain], $this->repo->findDomainsWithout('baz.com'));
     }
 
-    private function createShortUrl(Domain $domain): ShortUrl
+    /** @test */
+    public function findDomainsReturnsJustThoseMatchingProvidedApiKey(): void
+    {
+        $authorApiKey = new ApiKey(null, [RoleDefinition::forAuthoredShortUrls()]);
+        $this->getEntityManager()->persist($authorApiKey);
+        $authorAndDomainApiKey = new ApiKey(null, [RoleDefinition::forAuthoredShortUrls()]);
+        $this->getEntityManager()->persist($authorAndDomainApiKey);
+
+        $fooDomain = new Domain('foo.com');
+        $this->getEntityManager()->persist($fooDomain);
+        $this->getEntityManager()->persist($this->createShortUrl($fooDomain, $authorApiKey));
+
+        $barDomain = new Domain('bar.com');
+        $this->getEntityManager()->persist($barDomain);
+        $this->getEntityManager()->persist($this->createShortUrl($barDomain, $authorAndDomainApiKey));
+
+        $bazDomain = new Domain('baz.com');
+        $this->getEntityManager()->persist($bazDomain);
+        $this->getEntityManager()->persist($this->createShortUrl($bazDomain, $authorApiKey));
+
+        $this->getEntityManager()->flush();
+
+        $authorAndDomainApiKey->registerRole(RoleDefinition::forDomain($fooDomain->getId()));
+
+        $fooDomainApiKey = new ApiKey(null, [RoleDefinition::forDomain($fooDomain->getId())]);
+        $this->getEntityManager()->persist($fooDomainApiKey);
+
+        $barDomainApiKey = new ApiKey(null, [RoleDefinition::forDomain($barDomain->getId())]);
+        $this->getEntityManager()->persist($fooDomainApiKey);
+
+        $this->getEntityManager()->flush();
+
+        self::assertEquals([$fooDomain], $this->repo->findDomainsWithout(null, $fooDomainApiKey));
+        self::assertEquals([$barDomain], $this->repo->findDomainsWithout(null, $barDomainApiKey));
+        self::assertEquals([$bazDomain, $fooDomain], $this->repo->findDomainsWithout(null, $authorApiKey));
+        self::assertEquals([], $this->repo->findDomainsWithout(null, $authorAndDomainApiKey));
+    }
+
+    private function createShortUrl(Domain $domain, ?ApiKey $apiKey = null): ShortUrl
     {
         return new ShortUrl(
             'foo',
-            ShortUrlMeta::fromRawData(['domain' => $domain->getAuthority()]),
+            ShortUrlMeta::fromRawData(['domain' => $domain->getAuthority(), 'apiKey' => $apiKey]),
             new class ($domain) implements ShortUrlRelationResolverInterface {
                 private Domain $domain;
 
@@ -69,11 +105,6 @@ class DomainRepositoryTest extends DatabaseTestCase
                 {
                     return $this->domain;
                 }
-
-                public function resolveApiKey(?string $key): ?ApiKey
-                {
-                    return null;
-                }
             },
         );
     }
diff --git a/module/Rest/src/Entity/ApiKey.php b/module/Rest/src/Entity/ApiKey.php
index 59ff502b..937e42f0 100644
--- a/module/Rest/src/Entity/ApiKey.php
+++ b/module/Rest/src/Entity/ApiKey.php
@@ -80,7 +80,7 @@ class ApiKey extends AbstractEntity
 
     public function spec(bool $inlined = false): Specification
     {
-        $specs = $this->roles->map(fn (ApiKeyRole $role) => Role::toSpec($role, $inlined));
+        $specs = $this->roles->map(fn (ApiKeyRole $role) => Role::toSpec($role, $inlined))->getValues();
         return Spec::andX(...$specs);
     }