diff --git a/app/Http/Controllers/TokenController.php b/app/Http/Controllers/TokenController.php
index 8ef21d8bb58c..f095ca2070fe 100644
--- a/app/Http/Controllers/TokenController.php
+++ b/app/Http/Controllers/TokenController.php
@@ -50,6 +50,9 @@ class TokenController extends BaseController
         parent::__construct();
 
         $this->token_repo = $token_repo;
+
+        $this->middleware('password_protected')->only(['store','update']);
+
     }
 
     /**
diff --git a/app/Http/Requests/Client/StoreClientRequest.php b/app/Http/Requests/Client/StoreClientRequest.php
index dce5168dc87f..d68dddce70df 100644
--- a/app/Http/Requests/Client/StoreClientRequest.php
+++ b/app/Http/Requests/Client/StoreClientRequest.php
@@ -13,6 +13,7 @@ namespace App\Http\Requests\Client;
 
 use App\DataMapper\ClientSettings;
 use App\Http\Requests\Request;
+use App\Http\ValidationRules\Client\CountryCodeExistsRule;
 use App\Http\ValidationRules\Ninja\CanStoreClientsRule;
 use App\Http\ValidationRules\ValidClientGroupSettingsRule;
 use App\Models\Client;
@@ -51,6 +52,14 @@ class StoreClientRequest extends Request
             $rules['number'] = Rule::unique('clients')->where('company_id', auth()->user()->company()->id);
         }
 
+        if(isset($this->currency_code)){
+            $rules['currency_code'] = 'sometimes|exists:currencies,code';
+        }
+
+        if(isset($this->country_code)){
+            $rules['country_code'] = new CountryCodeExistsRule();
+        }
+
         /* Ensure we have a client name, and that all emails are unique*/
         //$rules['name'] = 'required|min:1';
         $rules['settings'] = new ValidClientGroupSettingsRule();
@@ -133,6 +142,7 @@ class StoreClientRequest extends Request
             // 'unique' => ctrans('validation.unique', ['attribute' => ['email','number']),
             //'required' => trans('validation.required', ['attribute' => 'email']),
             'contacts.*.email.required' => ctrans('validation.email', ['attribute' => 'email']),
+            'currency_code' => 'Currency code does not exist',
         ];
     }
 
@@ -158,6 +168,9 @@ class StoreClientRequest extends Request
             return $item->code == $code;
         })->first();
 
-        return (string) $currency->id;
+        if($currency)
+            return (string) $currency->id;
+
+        return "";
     }
 }
diff --git a/app/Http/ValidationRules/Client/CountryCodeExistsRule.php b/app/Http/ValidationRules/Client/CountryCodeExistsRule.php
new file mode 100644
index 000000000000..63aa2c0dfc9d
--- /dev/null
+++ b/app/Http/ValidationRules/Client/CountryCodeExistsRule.php
@@ -0,0 +1,60 @@
+<?php
+/**
+ * Credit Ninja (https://creditninja.com).
+ *
+ * @link https://github.com/creditninja/creditninja source repository
+ *
+ * @copyright Copyright (c) 2021. Credit Ninja LLC (https://creditninja.com)
+ *
+ * @license https://www.elastic.co/licensing/elastic-license
+ */
+
+namespace App\Http\ValidationRules\Client;
+
+use App\Models\Country;
+use Illuminate\Contracts\Validation\Rule;
+
+/**
+ * Class UniqueCreditNumberRule.
+ */
+class CountryCodeExistsRule implements Rule
+{
+
+    public function __construct()
+    {
+    }
+
+    /**
+     * @param string $attribute
+     * @param mixed $value
+     * @return bool
+     */
+    public function passes($attribute, $value)
+    {
+        return $this->checkIfCodeExists($value); //if it exists, return false!
+    }
+
+    /**
+     * @return string
+     */
+    public function message()
+    {
+        return 'Country code does not exist';
+
+    }
+
+    /**
+     * @return bool
+     */
+    private function checkIfCodeExists($value) : bool
+    {
+        $country = Country::where('iso_3166_2', $value)
+                        ->orWhere('iso_3166_2', $value)
+                        ->exists();
+
+        if ($country) 
+            return true;
+        
+        return false;
+    }
+}
diff --git a/tests/Feature/ClientApiTest.php b/tests/Feature/ClientApiTest.php
index affd7461d3c6..a481c3775f79 100644
--- a/tests/Feature/ClientApiTest.php
+++ b/tests/Feature/ClientApiTest.php
@@ -10,10 +10,12 @@
  */
 namespace Tests\Feature;
 
+use App\Models\Country;
 use App\Utils\Traits\MakesHash;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Foundation\Testing\DatabaseTransactions;
 use Illuminate\Support\Facades\Session;
+use Illuminate\Validation\ValidationException;
 use Tests\MockAccountData;
 use Tests\TestCase;
 
@@ -40,6 +42,77 @@ class ClientApiTest extends TestCase
         Model::reguard();
     }
 
+    public function testClientCountryCodeValidationTrue()
+    {
+
+        $data = [
+            'name' => $this->faker->firstName,
+            'id_number' => 'Coolio',
+            'country_code' => 'AM'
+        ];
+
+        $response = false;
+
+        try{
+        $response = $this->withHeaders([
+            'X-API-SECRET' => config('ninja.api_secret'),
+            'X-API-TOKEN' => $this->token,
+        ])->post('/api/v1/clients/', $data);
+        } catch (ValidationException $e) {
+            $message = json_decode($e->validator->getMessageBag(), 1);
+            nlog($message);
+        }
+
+        $response->assertStatus(200);
+
+    }
+
+
+    public function testClientCountryCodeValidationTrueIso3()
+    {
+
+        $data = [
+            'name' => $this->faker->firstName,
+            'id_number' => 'Coolio',
+            'country_code' => 'ARM'
+        ];
+
+        $response = false;
+
+        try{
+        $response = $this->withHeaders([
+            'X-API-SECRET' => config('ninja.api_secret'),
+            'X-API-TOKEN' => $this->token,
+        ])->post('/api/v1/clients/', $data);
+        } catch (ValidationException $e) {
+            $message = json_decode($e->validator->getMessageBag(), 1);
+            nlog($message);
+        }
+
+        $response->assertStatus(200);
+
+    }
+
+
+
+    public function testClientCountryCodeValidationFalse()
+    {
+
+        $data = [
+            'name' => $this->faker->firstName,
+            'id_number' => 'Coolio',
+            'country_code' => 'AdfdfdfM'
+        ];
+
+        $response = $this->withHeaders([
+            'X-API-SECRET' => config('ninja.api_secret'),
+            'X-API-TOKEN' => $this->token,
+        ])->post('/api/v1/clients/', $data);
+
+        $response->assertStatus(302);
+
+    }
+
     public function testClientPost()
     {
         $data = [
@@ -174,4 +247,45 @@ class ClientApiTest extends TestCase
 
         $this->assertTrue($arr['data'][0]['is_deleted']);
     }
+
+    public function testClientCurrencyCodeValidationTrue()
+    {
+
+        $data = [
+            'name' => $this->faker->firstName,
+            'id_number' => 'Coolio',
+            'currency_code' => 'USD'
+        ];
+
+
+        $response = $this->withHeaders([
+            'X-API-SECRET' => config('ninja.api_secret'),
+            'X-API-TOKEN' => $this->token,
+        ])->post('/api/v1/clients/', $data);
+
+        $response->assertStatus(200);
+
+    }
+
+    public function testClientCurrencyCodeValidationFalse()
+    {
+
+        $data = [
+            'name' => $this->faker->firstName,
+            'id_number' => 'Coolio',
+            'currency_code' => 'R'
+        ];
+
+
+        $response = $this->withHeaders([
+            'X-API-SECRET' => config('ninja.api_secret'),
+            'X-API-TOKEN' => $this->token,
+        ])->post('/api/v1/clients/', $data);
+
+        $response->assertStatus(302);
+
+    }
+
+
+
 }