diff --git a/include/coap/async.h b/include/coap/async.h
index 2c4135f3..7da37e5e 100644
--- a/include/coap/async.h
+++ b/include/coap/async.h
@@ -48,7 +48,7 @@ typedef struct coap_async_state_t {
   coap_tid_t id;                   /**< transaction id */
   struct coap_async_state_t *next; /**< internally used for linking */
   size_t tokenlen;                 /**< length of the token */
-  unsigned char token[];           /**< the token to use in a response */
+  uint8_t token[8];                /**< the token to use in a response */
 } coap_async_state_t;
 
 /* Definitions for Async Status Flags These flags can be used to control the
diff --git a/src/async.c b/src/async.c
index 3bbfcf1b..e0a9d3ed 100644
--- a/src/async.c
+++ b/src/async.c
@@ -47,14 +47,13 @@ coap_register_async(coap_context_t *context, coap_session_t *session,
   }
 
   /* store information for handling the asynchronous task */
-  s = (coap_async_state_t *)coap_malloc(sizeof(coap_async_state_t) + 
-					request->token_length);
+  s = (coap_async_state_t *)coap_malloc(sizeof(coap_async_state_t));
   if (!s) {
     coap_log(LOG_CRIT, "coap_register_async: insufficient memory\n");
     return NULL;
   }
 
-  memset(s, 0, sizeof(coap_async_state_t) + request->token_length);
+  memset(s, 0, sizeof(coap_async_state_t));
 
   /* set COAP_ASYNC_CONFIRM according to request's type */
   s->flags = flags & ~COAP_ASYNC_CONFIRM;
@@ -66,8 +65,9 @@ coap_register_async(coap_context_t *context, coap_session_t *session,
   s->id = id;
 
   if (request->token_length) {
-    s->tokenlen = request->token_length;
-    memcpy(s->token, request->token, request->token_length);
+    /* A token can be up to 8 bytes */
+    s->tokenlen = (request->token_length > 8) ? 8 : request->token_length;
+    memcpy(s->token, request->token, s->tokenlen);
   }
     
   coap_touch_async(s);